I have no evidence to back this hypothesis, but I wonder if that’s still more secure than using bad passwords.