The only person who could get hurt is the one who uses the same password for HN as they do for their bank. Is it the responsibility of the website developer to protect that person from themselves?
Protect their password as much as possible when interacting with your web app/website I would say yes.
I don't think about it as a responsibility rather just a nice or the right thing to do.
This attitude is absolutely not ok. You need to make sure the security of users accounts if a top priority, even if your app is 100% trivial in nature.