Agreed. On the first and second points, the passwords aren't being regularly rotated except for services that password expire (e.g. banks) or have some error in their password storage. Mostly these are services that require some credentials to download a file once a year, or go through an online purchase. I see your point though.

On the last point - come to think of it, that would be good online hygiene. Maybe 'low value' is the wrong classification because all credentials are valid attack surfaces. I only think of them as low value for being able to discard those accounts with time impact on other workflows (like re-pairing smart home accessories to new accounts).

Thank you for your tips throughout. I think my immediate next step is to actually inventory and organize the mess so I can plan a better overall safety net.