How is standard, restricted user password security in any way related to site security (assuming the site is consciously making the tradeoff)?

That's an exercise with a huge multitude of variables, but at the core, a website that cares more about selling widgets / booking accounts to the point of reducing its depth of defense with user passwords leaves a very sour taste in my mouth.

Most sites out there must leave a sour taste in your mouth then, including Amazon, Netflix, and Newegg.