First let's examine what the conclusion actually is.

Notice, the argument does not say that using randomly generated passwords would create perfect security. What it does say is that doing so would "improve security".

A does not really undermine that conclusion. Yes, A says that it is theoretically possible that randomly generated passwords could somehow match passwords that employees would have created on their own, but given the use of the word "theoretically", we can safely conclude that the possibility being discussed is remote and that even if this matching were to occur it would not happen often.

Additionally, and possibly more importantly, even if in some proportion of cases this type of matching were to indeed occur, since in the majority of cases the matching would not occur, the conclusion, that using randomly generate passwords would "improve security" would still hold.

If even some of the passwords generated are more secure than those that would have been used otherwise, then security is improved. So A does not undermine the argument that using randomly generated passwords would "improve security".

B on the other hand discusses a security compromising event that, rather than being theoretically possible, actually has been seen to occur, not rarely but often. Given what is said in B, it seems possible that rather than improving security, using randomly generated passwords would reduce security.

Notice how once you clearly see the logic of the argument and answer choices, choice A, which initially seemed possibly valid, becomes rather apparently not the best answer. The logic that makes the OA the best choice is virtually mathematical in its precision.