Given that steemit accounts usernames are visible to anyone, it means that the only thing standing in the way of someone breaking and entering into anyone's account is the password.
This effectively is the equivalent of holding an NXT account. Now those who have opened accounts on NXT know that passwords are only used to log in but also they are lengthy, 50 characters at least. This is a preventive measure aiming to counter the brute force attacks that are randomly checking passwords hoping to log in to an account that holds some NXT.
In the case of steemit, things are much easier since
1. usernames are still visible,
2. balances linked to usernames are visible too.

Meaning that it is times easier for a hacker to focus all resources available to accounts that will pay back if hacked.

Now in a previous post I suggested that a nickname should be used to assign the posts publicly, avoiding to expose the username used to log in. An alternative to that would be to detach the username from the log in process and enforce longer passwords, and/or keys.