I don't know that the site has been hacked, that's the point. I'd rather not automatically throw my password into a form when I visit a site. It seems like a kind of obvious thing to me.
Leaking one site could allow someone access into another site. For example, if I've integrated API keys from one site into another. It is those sorts of targets that hackers really look for.