Seems as if they simply went with a wrong assumption from the beginning, then disobeyed the venerable law, "When in a hole, first stop digging."

The whole thing could have been a lot easier.

Create a nonsense phrase and sub one cap and one symbol and add a space or two. I use complete sentences. One such is twenty four characters long. The more there are the more difficult it will be to decipher.

A lot of sites allow certain punctuation characters (as in they don't give you an error) when picking your password, don't specify it as being prohibited in the note for the password, but if you actually attempt to use that character in your password, cause an error that won't allow you to log in.  I had this issue actually with my password I used to sign up for my stardock account back in 2006, and a lot of other sites.  And, yeah, its very annoying how some sites limit the length of your password ... that can't be secure at all. :/

Dictionary attacks are only effective against single words, common phrases/combinations, and simple character substitutions. The only scenario where they could be useful against a passphrase such as 'correcthorsebatterystaple' would be an offline, focused cracking attempt where the attacker already has reason to believe the hash they are trying to crack is such a phrase.

Extending the space to the whole of the English language, rather than just ~2000 common words, renders even that totally ineffective, because then the search space grows from powers of 2000 to powers of 200,000 (by extremely conservative definitions of 'word') or even millions. Again, that assumes the attacker even knows the password is made of English words.

So if you're making a password for nuclear missile launch controls and tell someone that the password is made entirely of common lowercase words, you probably have cause for concern.... but otherwise, a phrase like that is plenty good enough for most uses (assuming password rules allow it).

Unless you have a trivial password or an educated attacker, nobody is going to guess a login online unless the site doesn't implement any kind of lockout after X incorrect guesses. Online breaches are generally the result of social engineering first, malware second, and cracking a very distant third.

Realistically, the common scenario for password leaks these days is a database compromise (there have been a lot of high profile leaks since 2011 when that cartoon was made). In that case, the attackers are just going to crack the low-hanging-fruit (using mainly dictionary and min-length brute force attacks, less so pattern-based guessing) and just gather whatever information they can from the rest to use in other ways (spear phishing, etc.).

And also on the hashes being unsalted and MD5, which are both worst practices.

The article would be a lot less interesting if the hashes were salted. Based on the hashing rates and times to cover given search spaces in the article, they took advantage of the lack of salt by comparing every guessed hash against the entire set, which is substantially easier and more productive than doing it individually.

With salt, the first pass that revealed all the <6 length passwords in two minutes would have taken a week or two instead. And the more sophisticated pattern-based attacks would have been totally infeasible without a lot more hardware.

I have an acquaintance who makes his living consulting on computer security issues.  We've had a number of conversations on this topic.  His practical take:

The law of diminishing returns applies to passphrase security, just as it does to most things.

Forcing password changes every 60-90 days is completely counterproductive and not 'safer' - in fact may compromise security by exposing passphrases to unauthorized others (e.g., writing them down somewhere).

A plain-language sentence of 10-12 characters or more that you can easily remember, without spaces, is as secure as any random-character passphrase; he picks a sentence from a favorite book.

Using the same such password for all your financial sites/transactions (anything you consider important or want to remain secure) is fine, provided you use a different password for all non-financial/non-commercial (unimportant) activity (email, Facebook, etc.).

He uses only two passphrases (important/unimportant) and may change them every year or two.

YMMV.