I'd say you're right to be paranoid..and I can empathize to some degree with you about using lesser known sites, though that is the point I would disagree with- what you speak about isn't just exclusive to the low-quality, lesser-known sites of the world, and passwords don't need to be simply stored in plain text in order for them to be useful to an attacker for future endeavors.
What you are referring to is essentially a breach and data leak of sensitive information/PII, or personal identifiable information, read more here. One of the most recent examples of this happening at a large scale was the Equifax breach of 2017.
I also find the manner in which Equifax is allowing people to see if they've been compromised to be extremely ironic. Shown here, in order for Equifax to help you to determine if your information was in fact leaked they are requiring you to input your last name was well as the last 6-digits of your social security number.. I digress.
There are resources like Have I Been Pwned? by security researcher Troy Hunt that will check known email leak lists to help you determine if your email has been leaked during a breach.
And to your last point, these malicious websites exist and are quite common. There are a number of methods for how attackers can trick people into visiting their sites and divulging information but the overall scheme of this is known as Phishing. Much more can be said about this topic but this could be in the form of doppleganger websites, fake shopping websites advertising great deals and can even extend to ill-intended cryptocurrency token launch websites, etc.
Hopefully the above helps to suggest the importance of rotating passwords, not reusing passwords, and constantly being vigilant online!
