I had an idea for a website password system: instead of letting the user set a password, you just give them one. Prevents password reuse, which is the only thing that ever really commonly gets anyone's account hijacked in my opinion.

Doesn't even have to be strong, could be one word from the top 10k English words. Require reset after 5 failed attempts.

Would there be anything wrong with this approach (besides being sort of user-hostile), or have I misunderstood the website account security threat model?