REAL WORLD
A forgotten website gets breached.
You created an account years ago and barely remember it exists. That company is breached and your email address and password are exposed.
An attacker may not care about that site at all. They care whether those same credentials work somewhere more useful. Trying known credentials against other services is called credential stuffing. The attacker is not cracking your password. Someone else already gave it to them.
CREDENTIAL STUFFING
Breached website
Email
Microsoft 365
VPN
Banking