[exiguus]

Maybe they can't. But actually, you can install them a password manager and let them generate random password. Setup with them 2fa (FreeOTP or something). And change with them every password when you are at home for chrismas.

Also, when they now found themself on have i been powned, they have a bigger problem, because they have likely malware on the phone or computer.