I'd argue that under some conditions: I feel it's secure enough for locking a phone for example because a phone won't allow any form of brute-force unlocking th

I'd argue that under some conditions: I feel it's secure enough for locking a phone for example because a phone won't allow any form of brute-force unlocking that would allow an attacker to try, lets say 1 password/sec. Same goes for pin codes on debit cards. Same goes for a physical combination lock safe: 1 million possible combinations would take an impractically long time to crack on average in a realistic real world attempt. For things like hard drive encryption where you can get the specific piece of hardware and have software brute force it then yes I agree it's insufficient.