> The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.

There's not much to be done about storing a username (though if you don't want the connection made it's already obviously smart not to have the same username on AO3 as on say, Facebook) and anonymous mail accounts make sense for fan work every bit as much as a PO Box does - but for passwords we can just do better and it makes sense to me as a worthwhile piece of engineering for AO3

WebAuthn lets a site work with Security Keys and that makes such a loss basically harmless unlike for password hashes.