1) Weak passwords are not ok even on throw-away accounts. Just because you have no use for it, doesn't mean nobody has. Sending spam, or impersonating you or some other creative use.
2) Nobody is going to bruteforce your password. We don't use md5 anymore. You password will get stolen. By phishing, malware, social engineering, password reuse etc.
Lot of websites you'll visit once per decade (maybe) still ask for account. Or things like the software you get to manage your gaming peripherals which nowadays all ask for an account for no reason.
Those accounts getting hacked? I don't care. So they all get a shitty birthday password if they accept it. If they prefer to use some stupid "X uppercase, Y lowercase, Z numbers, some special characters" I'll make a new account next time because I'm not using a real email. Or just stop there.
Security is a bit like traffic. If you're alone in the world, you do you. But you are not alone, you have a responsibility to others, be it passers by, fellow travellers or those loved ones depending on you making it back alive.
Frankly, in a lot of these cases the site owner (e.g. Razer) has already decided to put their interest ahead of mine by requiring accounts to e.g. configure peripherals locally so they have can harvest sign ups for their marketing lists or tell investors they have XXX MAUs. I don't care if my password choice inconveniences them in turn.
Same thing, I create a random account with random creds each time I want to use it. And there will be zero impact for me if it leaks...
Why should that be my problem? It reeks of the same bait-and-switch that banks are doing, with calling failures of their lax KYC/security process "identity theft", calling themselves the victim, and making the actual victim responsible for it.
Now it's called "identity theft" and they've convinced many of us it's our problem. So much that people pay the banks to buy "identity theft protection"!
For instance this requires an account
They can be okay for throw-away accounts, it just depends on the circumstance.
> Nobody is going to bruteforce your password.
I can assure that there are still people brute forcing passwords. I see it happening all the time, especially for SSH accounts. While you are correct that phishing and password reuse are problems, they are also not totally solved by using 2FA.
This accidental confusion between TOTP and OTP is by itself an argument against complex alternatives to login+password.