The employer should be performing proper audits and password rotations and/or educating their employees. It should never be "stupid users", but "stupid me".
I'm not saying that's good, but I could definitely see it happening.
If you don't do this, the customer DPO might stop the project anytime, or you would have to undo all the reso it again untilt the DPO approves it.
Sorry but no. No.
Where are they supposed to get this information if they're never taught it?
> at what point would they be so blind as to not know / have read about hacks of others and/or the existance of haveibeenpwned and seen the error of their ways?
Most people outside the tech departments have no idea what those things are. They think hacking is stuff that happens in movies, not in real life.
Sorry, but yes yes.