That’s a third thing: most people don’t use either random passwords or XKCD-style passwords; they use a combination of words, letters, and punctuation that cont

That’s a third thing: most people don’t use either random passwords or XKCD-style passwords; they use a combination of words, letters, and punctuation that contain some memorable context. That generally produces very mediocre (but not completely terrible) passwords, which a strong KDF then transforms into an infeasible amount of work.