[jackdh]

Likely cheaper just to force everyone to change their password on login.

[Gigachad]

That would be pointless since the malware could just grab the new credentials.