I think this is exactly right. My bank has predictable account numbers too, and if they had one of these 4 or 5 digit password limitations, they would be a very

I think this is exactly right. My bank has predictable account numbers too, and if they had one of these 4 or 5 digit password limitations, they would be a very ripe target for someone using a botnet to just go through all the accounts. The risk isn't that someone will target you personally, the risk is that someone will happen to hit you while attempting the profitable activity of hacking every account. (Plus, at least with a bank, if they manage to hack in and steal the database, one of the most profitable ways to use it would just be to log in and steal money. No effective hashing on a 5 char password.) I also completely distrust the "advanced security measures" claim. I have no trouble logging into my bank via curl, including from remote IP addresses. (They finally rolled out 2FA, but I can still type the text code into my script.) A couple years ago I discovered a number of vulnerabilities in their account site, too (including some many years old software with vulnerabilities with a CVSS of 10). After I reported this to them, the response from the guy who worked there was basically "Yeah, that's from the crappy vendor who supplies us with this software. Please don't say anything about this because we're replacing it with a new in-house backend in a couple months."