I believe the bigger failure mode in that scenario is the fact that the site was storing user passwords in plaintext (either directly or effectively). Users tend to reuse passwords, so when there's a breach, more than just the user accounts for that site would be compromised.

No site should be able to give you your password because they should never store it. They store the hash of the password and whatever password you provide is then hashed and compared to the stored hash.

That way, when their security is compromised, the attacker doesn't get your password.

Any site giving you your password is doing it wrong because they should never know it.

NSA probably read and stored a highly significant fraction of those emails.

This is a very odd take in the world where your device will connect to any old wi-fi.

On top of that any takeover of a device like an ISP router or BGP misrouting is now an automatic compromise.