You definitely need glasses then.

Let me specify: The user must have entered his data on one site which the attacker has control of. That is a high bar still.

it really isn’t.