Because you're not special, and you're not smart either. Your adversary already knows your password derivation scheme, and are already checking for it during th

Because you're not special, and you're not smart either. Your adversary already knows your password derivation scheme, and are already checking for it during the brute-force step, because you're not the first one to come up with it. Browser and operating system vendors aren't especially smart either, but at least it's thousands of white hats vs thousands of black hats, instead of thousands of black hats vs just you.