I don’t think Firebase deserves to be blamed here. If anything username-password combinations are becoming in general discouraged. If the user is lazy enough to add in a crap password, I don’t see that as a security hole in Firebase.