That sounds like guesswork, don't we already know which passwords are in common use from the various large-scale breaches? You could even use that data to train

That sounds like guesswork, don't we already know which passwords are in common use from the various large-scale breaches? You could even use that data to train a character sequence model (e.g RNN), but really just randomly selecting from the 1000 most common passwords should be superior?