True but in reality an attacker won't just use any dictionary. They look at password leaks, figure out what passwords people are actually using and what the mos

True but in reality an attacker won't just use any dictionary. They look at password leaks, figure out what passwords people are actually using and what the most popular ones are. You also can't assume that all accounts are equally valueable. An attacker might very well prioritize some of them. This doesn't render all of this useless but I think you shouldn't consider even best solutions out there to be anything else than a temporary barrier. It's a good one and you probably will have enough time to change your password after a leak but you really do need to change your password within a week or so.