Security Experts the world around all agree that you should not reuse passwords across sites. This is simply a matter of best practice, and it protects you such that if your StackExchange password is stolen, they can't use that to access your bank account.
The general feeling I get from my security friends is that this "advice" is legally bulletproof, and that if their website is hacked, and plaintext passwords are stolen, they don't have to worry about someone suing them because the password that was stolen from their website was also used on that person's banking page. After all, "It's the user's fault for reusing a password!"
Has this belief actually been upheld in court yet? Or is this a firestorm waiting to happen when Amazon turns out to be the victim and they sue some smaller organization for every penny it has?