That's great. I've been thinking about and even prototyping something like httpoffenders.com. Glad to hear it's already beeen done
Most of the sites on there are because of things like they will email you a temporary password forcing you to change it on first login. Digital ocean has a big red banner because if you don't provide a private key, they send you a randomly generated root password for new servers you make.
FFS apple.com is on their list because someone SENT IN an email with their username and password for their phone on it, and they replied with a "work authorisation" letter that included the message they sent it...
That's not what it's meant to stop...