But that is bullshit and we both know it.
There will always be a bad implementation, or a mistake, or an insider, or a man in the middle. If all their 100 accounts are the same creds, it only takes one time and they're fucked.
It is completely impossible to have perfect security on all these accounts. It is inevitable that one will get cracked. At that point, blaming anyone but the user is lunacy.
It is Pandora's ethical duty to do their part. And it is the ethical duty of other sites to do their part.
It is the user's duty to do their part.
Any one of these parties slacking does not excuse slacking on the part of others.
This is not a perfect world. We all know there are people who use the same password everywhere. Since we know that, it is our responsibility to do our part.
But, seriously, whether they should be or not the fact is Pandora is hosting sensitive information and they need to act like it. They shouldn't need to lock it down like Fort Knox, sure, but password hashing is considered a bare minimum these days.