The app was still stuck in beta testing years after its debut, and the creators had to ignore bug reports and feature requests due to the limited resources.

Good commit hygiene in general is a tough thing to enforce. It requires manual labor and descipline, from both the author and the reviewer.

Other sites could absolutely spend time crawling for new lists of breached passwords and then hashing and comparing against their own. However this is an intensive process and I'm sure both Facebook and Google have a team dedicated to account security with functions like this.