> Malware events net maybe thousands of user passwords? On a good day maybe 100k.

You are underestimating how much malware there is out there, both on desktop and mobile. There are probably botnets that consist of >100k compromised machines.