And an 12 character password only giving you ~500 possible subselections means if the 4 character string was stolen, you could brute force in within a few minut

And an 12 character password only giving you ~500 possible subselections means if the 4 character string was stolen, you could brute force in within a few minutes. This is hardly better than than just leaking the entire password.