well that would leave a REALLY bad taste, I mean the idea that things like 2fa recognition which requires cataloguing sites and checking for password leaks also is dependent on online services and therefore create cost (assuming they arent just directly using the pwned passwords API, someone should maybe look into that) needing recurrent costs is kinda legit tbh