"Too much trouble" is the whole point. The value of security for such accounts is approximately zero - if some solution doubles (or creates?) security but requires an extra click or two, then it's a bad tradeoff that simply shouldn't be done.
Why should people spend any effort at all to secure things that shouldn't be secured in the first place? Why should anyone remember a single bit of info or download an app or spend an extra keypress to protect an account that's already public in intent; but "private" because someone else wanted it to be private?
There are security problems if you use your 'throwaway' password for your primary email (as some of the people on Adobe list have done), but that's not the fault of the throwaway password, but in throwing away the keys to something valuable. That throwaway password should be something that's not a secret, as an equivalent to no password.
It should not even attempt to be protected - it's something that you tell your friends/colleagues openly (so that they'd not have to create their own accounts there, it's quicker to login with yours), post it publicly on the internet (again, bugmenot.com as an example), don't bother to change it years after some site has leaked it, etc. The password as such exists only because someone forces you to some tradeoff of "more security/less usability" - the only reason that the password is not, say, a 0-length string is that you're forced to do so, but there's no reason at all to go any further than the minimum.
For the majority of accounts that I have, the most appropriate level of authentification is not "a reasonable level", not "a minimum", but exactly zero.
I think new models and progress will have to be based on looking at the technologies available, such as cryptography and web protocols, and figuring out what are the best and most convenient systems you can assemble for various levels of security. For instance, a site can track your visits with a cookie, without your creating an account, as long as you use the same browser and the cookie doesn't expire. Cookies seem like almost enough for a lot of scenarios, except that you can't (currently) transfer them to a different browser and there's no standard way to distinguish the person that owns a cookie if multiple people use the same browser.
The value of security for such accounts is approximately zero
If I'm following your logic correctly, you might as well not go to the extra expense of vaccinating your kids, because the anti-vaxxers have already broken down herd immunity.
Basically the rest reduces to: "I know enough to know better, but using a Password Manager is too much trouble."