

Yeah, but there are degrees of vulnerability. Otherwise, things like password strength or MFA wouldn’t matter.
If all your passwords are fully random, then that’s one less weakness that can be exploited. People can’t make educated guesses about your passwords just from analysing your social media profiles and history, e.g. if you post a lot about Star Wars, it’s more likely your passwords could contain a Star Wars reference.
snake_case_ftw