Most intrusions do not begin with a clever exploit. They begin with someone logging in.
That sentence is worth sitting with, because it contradicts how the job is usually taught. An attacker who has a working username and password does not need a vulnerability. They are not breaking in; they are walking in, and every control you built to stop code from executing is irrelevant to them.
There are three things a system can check about you. Something you know, which is a password. Something you have, which is a phone or a hardware key. Something you are, which is a fingerprint or a face. A password alone is the weakest of the three, and it is the one almost everything still defaults to.
The reason password reuse matters is arithmetic, not morality. A person has perhaps two hundred accounts and perhaps four passwords. When any one of those services is breached — and one of them will be — the attacker does not get one account. They get a list, and they replay it everywhere. This is credential stuffing, and it works because the arithmetic is on their side.
A credential-stuffing run looks unmistakable in authentication logs once you have seen one: failures rise sharply and suddenly, while successful logins barely move. The pattern is unmistakable once you have seen it. Huge volume, distributed usernames, almost total failure — because the attacker is testing a list harvested somewhere else entirely.
Credential stuffing only works at scale where password reuse is common and the second factor is optional. That is why the defence is not telling people to choose better passwords — it is making the second factor the default rather than a setting somebody has to find.
One more thing, because it is the part people miss. After you authenticate, the system stops checking your password and starts trusting a session token. Steal the token and you skip authentication entirely — which is why "we have MFA" is not the end of the conversation. Sessions expire, are bound to a device, and are revocable, or they are a password with extra steps.