With sane defaults, bcrypted passwords are "worthless" in the hands of a casual attacker. Somebody would have to REALLY want to access your account and have SI

With sane defaults, bcrypted passwords are "worthless" in the hands of a casual attacker. Somebody would have to REALLY want to access your account and have SIGNIFICANT financial/computational resources to crack it. And that only gives them one password. Significant and independent work is required for each individual password. On the other hand, there's nothing stopping a developer from doing something really dumb like setting bcrypt iterations to 1.