Earlier quoted context omitted.
evil hax0r has database of leaked hashes from shittyonlinewebappyoudidntknowyousignedupfor.com, which includes your email address and a bad hash of your password. They run them through some standard password dictionaries using hashcat and break all of the 'letmein', 'monkey', 'qwerty', '111111' passwords within seconds. Then they run some bigger dictionaries and some nice rule-sets and crack another 50%. Then they st…
As someone pointed out above, the problem with this argument is that the password becomes cipher text. That means that each time it is gathered by an attacker it gets easier to compromise. For most of us, this is not an issue because there is so much low hanging fruit. For some -- say a celebrity or person of public interest -- this could be a serious problem as they are already the target of a focused effort.
I don't think this is relevant. You still need to inverse the key-derivation function. If you know a hundred passwords, this will be technically easier than if you know one password, but it should not matter if the security margin of the key-derivation function is high enough.