You definitely need glasses then.
Let me specify: The user must have entered his data on one site which the attacker has control of. That is a high bar still.
it really isn’t.
Examples?