After reading the post about linkedin on IT security and this issue I would think that having a default Drupal 6 installation without, for example, the phpass module should be considered quite insecure, since the passwords are stored in a way which doesn't require much force to guess and check.
Should I run and install phpass on every Drupal 6 site?
Yes!
You should consider Drupal 6 without phpass to be unnecessarily insecure. And yes, you should use phpass on all your D6 apps. There are reasons they've changed the way things work in Drupal 7, and made the same changes available as a module to D6 users.
There is no silver bullet, but there's no reason to ignore an easy-to-use module that will significantly increase your level of security.
Not using it is a little like not wearing a seat belt: of course you want to avoid ever being in an accident to begin with (analogous to ever letting anyone gain access to your data), but once you have an accident it's far too late to try buckling up. Buckle up now!
Update: A security expert seems to agree with me:
...take the view that attackers will ultimately get into your network, access your data... you should be looking at the problem differently.
Security happens at many different points in the system. As far as I'm concerned if a hacker already has full database access it is game over.
To help protect your user's privacy I would do everything you can at the server level to prevent that from happening.
Another step you can take is sanitizing the user data you don't need when moving around development databases. If you are not using the password hashes in development leave them on the production server where they are secure and less likely to be misplaced.
That being said adding phpass definitely doesn't hurt. My philosophy on security is to cover as meany weaknesses as possible without driving yourself crazy chasing edge cases and it seems easy enough to add to the mix.
