Yes, that's pretty much the right take-away from this. The whole reason why key stretching techniques like PBKDF2 are so vital is that people simply cannot be e

Yes, that's pretty much the right take-away from this. The whole reason why key stretching techniques like PBKDF2 are so vital is that people simply cannot be expected to remember passwords strong enough to resist brute force at the speed we can achieve these days if they're just hashed with MD5, SHA1, or any of the other cryptographic hashes. That's true whether they're random words, random letters, or any other scheme you can think up.