In the end there's a password strength ceiling, and that ceiling is the moment it becomes harder for someone to crack your password than it is for them to pay s

In the end there's a password strength ceiling, and that ceiling is the moment it becomes harder for someone to crack your password than it is for them to pay someone else to come threaten/beat you into giving them access. Anything stronger than that is just security theater. Heck, even if you assume your opponent is mostly law-abiding the password ceiling is however many dollars it takes to set a bounty that results in someone finding a 0-day for the platform for which they want your access.