Another, more indirect take on this: because of the semantic security requirement, we evaluate ciphers by their ability to resist an adaptive chosen-plaintext attack—where the attack not only sees some plaintext/ciphertext pairs, but also:
- Gets to choose which plaintexts they wish to see ciphertexts for;
- Gets to use the knowledge they gain from earlier choices to make later ones.
And not only that, we don't require that the attacker be able to actually decipher messages before we declare them victorious. They win if they meet the much lower bar of distinguishability.
Compared to this, the ability to decipher messages from non-chosen known plaintexts is a scenario where an attacker has fewer advantages and yet accomplishes more. So totally broken, yes.
Of course, that shifts your question around. Why do we consider ciphers to be broken if there's a distinguishing attack with adaptive chosen-plaintexts? Several reasons:
- Semantic security: We don't just want that the attacker be unable to recover the plaintext. We want the attacker not to be able to learn anything about the plaintext. That's why cryptography aims for the high bar of indistinguishability—it's the one thing that guarantees semantic security.
- Interactive protocols: Cryptography today is used by programs that communicate through interactive client/server protocols, where attackers are often able to cause servers to encrypt plaintexts of their choice. So safety from adaptive chosen-plaintext attacks is a suitable high bar to guarantees that this doesn't give attackers any advantages.
- Other applications: Ciphers aren't just used for encryption. They're also routinely used for random number generation, for example by running a block cipher in CTR mode. In this case the plaintext is a sequence of blocks with public nonce and counter values, so the attacker knows all of the plaintexts!
- Conservativeness: Setting a very high bar for the defender and a very low one for the attacker is just safer. Remember that the attacker always has the advantage:
- The cipher's designer has to defend against attacks that nobody has though of yet;
- The attacker is free to come up with new attacks years after the cipher design was done.
And note additionally that even though it is good and common practice to rekey often, modern cryptography almost always involve some amount of key reuse—either literally (using the same key to encrypt more than one message), indirectly (using a block cipher mode of operation to encrypt a message longer than the key), or in the very loose sense of just using a key shorter than the message.
But the other thing to say is that many of the motivations for rekeying are driven not by the fear not that cipher will be broken, but rather by key management concerns—the fear that some of keys will be disclosed. Rekeying frequently limits the damage in such scenarios.