Adding extra random characters to the end of the passphrase requires effort from the user, key derivation only requires them to wait. Ideally, one should use a

Adding extra random characters to the end of the passphrase requires effort from the user, key derivation only requires them to wait. Ideally, one should use a strong passphrase with strong key derivation parameters. You're free to make whatever security trade-offs you like, but don't presume they make sense for everyone.