I do assume that almost all online services will be pwned. I have a small amount of faith that my Google account, Amazon account, and (major) bank account won't be compromised except by my government. Maybe a few other services are this trustworthy to me, but not many, and I can't think of them off the top of my head.
We just need to get used to using throw away credit card numbers from our credit card's website. Or buy game currency/points/time in stores, in the form of cards, to prevent giving out the info that will be pwned sooner or later, on one service or another.
And get used to using throwaway passwords. If your password being compromised on one service makes you worry about other services, you've already done it wrong.
I assume my passwords will be stolen. I even have a generic password I use for many sites that I do not and will never trust.
It could be stolen -- and hell probably has, knowing how many services have been pwned, and how many don't even realize it. But it won't give you anything close to access to any email, bank, or merchant website connected to my debit card, as they're all using unique passwords and 2-factor auth where available.
Startup Idea: Debit/Credit card services that provide not "throwaway" numbers, but separate numbers/info for every major subscription or service you use. Generate an Amazon number, an Xbox live number, a number for your cellphone payment. If any one number is compromised, it can be disabled and handled without any interruption or issue to other numbers and services.
In the age of constant pwning, a debit card that isolated the damage to that one service without any hassle or disruption to any other service would be brilliant. I know I'd pay for that. In fact, how easy would fraud monitoring be when the only charges to a specific number would be allowed from that 1 service. It makes the numbers useless outside of that 1 service you're using it for, even when stolen.