Sure, why not?

Passwords have been leaked from many companies you’d expect to have decent security policies. I have no visibility into that, so I would not assume competence across an arbitrary number of sites. God only knows how many of the services I use store my password in plaintext, or improperly hashed.