evil hax0r has database of leaked hashes from shittyonlinewebappyoudidntknowyousignedupfor.com, which includes your email address and a bad hash of your password. They run them through some standard password dictionaries using hashcat and break all of the 'letmein', 'monkey', 'qwerty', '111111' passwords within seconds. Then they run some bigger dictionaries and some nice rule-sets and crack another 50%. Then they start trying to crack the more difficult ones. GPUs come out and some fancy machine learning. Then they do some specialised stuff, like implementing the LessPass open source function to start trying to crack LessPass specific passwords. This is now as difficult to crack as your master password for LessPass, but it's "security through obscurity" because they have to guess that you use LessPass, and will probably only start attacking your password once all the low-hanging fruit is gone, giving you more time to change your password/ delete your affected account, etc.

As someone pointed out above, the problem with this argument is that the password becomes cipher text. That means that each time it is gathered by an attacker it gets easier to compromise. For most of us, this is not an issue because there is so much low hanging fruit. For some -- say a celebrity or person of public interest -- this could be a serious problem as they are already the target of a focused effort.

> That means that each time it is gathered by an attacker it gets easier to compromise.

I don't think this is relevant. You still need to inverse the key-derivation function. If you know a hundred passwords, this will be technically easier than if you know one password, but it should not matter if the security margin of the key-derivation function is high enough.