Steam

Sure you can blame the user for their failure, but your systems will be less secure because of all your users who are not doing what they are supposed to. So then you have to decide, do we punish these users for their bad password practices or do we implement different practices that are more likely to be followed.

Something you know isn’t the best method to verify identity anyways; as evidenced, it is easy for someone else to learn that information. Using something the user possesses is a much better choice as the user is more likely to be aware of a loss of the object and report the security incident.