There is some very bad analysis or interpretation done here. Just with one or two minor tweaks the analysis falls flat. For instance, they seem to only look a

There is some very bad analysis or interpretation done here. Just with one or two minor tweaks the analysis falls flat. For instance, they seem to only look at mass scale script kiddie sprays, a targeted attack will likely not use the mentioned passwords. As one can come up with much better and more likely to succeed candidates. It also entirely misses attacks that come from a more privileged position (like in Windows directly authenticating to the domain controller) where an adversary can do millions of attempts in short time because of typical monitoring gaps.