Surely you see the difference between someone copying all of your passwords without your knowledge, and someone resetting your password for a single website that you would immediately notice when you check your email? They are two completely different types of attacks.