Why do we need strong password if the account is on a secure website?

That's like asking why you need a gate at a maximum security prison.  Weak passwords imply weaker security.  You assume that websites can perfectly block brute force attacks.  This is not true.  Hackers can try different techniques, such as rate limiting queries, or sending queries from different machines (like from a botnet).  How do you tell the brute force requests from legitimate requests when you're receiving lots of traffic from all across the web? One example of a weak password would be a reused password.  Suppose a user shares the same password at both a low security site and a high security banking site.  Now what happens if the low security site is compromised and the password is leaked?  Hackers know people reuse passwords and try them out on high security sites.

Because even if the site is secure, if your log in name is known, someone could figure out that your password is "joesaccount1" or "abcdefg2".