Friends use password managers like lastpass or dashlane which have plugins for the browser, but not for the email clients (thunderbird or livemail). But surely the email password is the Achilles heel of security because if you have that you can easily perform password resets to get access to any websites used.
If the password manager doesn't protect your email client a trojan can steal your email profile containing the email passwords.
Of course if you don't use an email client you don't have this vulnerability, but many still do. Many people use password managers and email clients so where's the flaw in my logic?