In a great many small businesses there is one login that everybody uses. It might be for the booking system, the supplier portal, the social account, the till software or the shared mailbox. Nobody decided on this arrangement; it simply grew. One person set the thing up, a second person needed to get in, the password was passed along, and by the time there were five people it was the established way of working. It is genuinely convenient, it costs nothing, and it removes a whole category of small daily friction. That is exactly why it persists, and why arguing against it on security grounds alone tends not to land.
The security objection is real but it is not the strongest one. The stronger problem is that a shared login destroys the ability to know who did anything. When a booking is cancelled that should not have been, when a price is changed, when a post goes out with a mistake in it, when a record disappears, the system will faithfully record that it was done by the shared account - which is to say, by everybody and therefore by nobody. There is no way to reconstruct what happened, and more importantly no way to find out what went wrong in the process so it can be fixed. The business loses not the ability to blame someone, which matters little, but the ability to learn, which matters a great deal.
The second problem arrives when somebody leaves. A shared password is known to everyone who has ever worked there, including people who left three years ago, and it can only be changed for everybody at once. So changing it is a small disruption affecting the whole team, which means it is postponed, which means in practice it is rarely changed at all. Every former member of staff retains access indefinitely, not through any malice but through simple inertia. And because nobody can say exactly who knows it, the business cannot answer the one question that matters after an incident: who could have done this.
The fix is individual accounts wherever the software allows them, which is more often than people assume - many services include multiple users at no extra cost and the feature is simply never switched on. Where the software genuinely allows only one login, a shared password manager is the next best arrangement: everyone can get in without the password itself being passed around in messages and remembered, and access can be withdrawn from one person without disrupting the others. Neither change takes long. What makes them worth doing is not the fear of a breach but something more ordinary: when something goes wrong, the business can find out what happened.