This is probably going back 20+ years, but given old tools like john the ripper, newer tools like ighashgpu, or just writing your own iterative tool to go throu

This is probably going back 20+ years, but given old tools like john the ripper, newer tools like ighashgpu, or just writing your own iterative tool to go through [a-z][A-Z][0-9]@<populardomain>, and the advent of high speed CPUs and GPUs, you'd be able to generate rainbow tables of millions of md5 hashes in a few hours/days/weeks (depending on length and complexity of course). So yes, literally every security expert out there knows md5 hashes are weak, hence the advent of salted hashes, and nowadays sha and variants, as well as well-known hash types for passwords like bcrypt/argon2.