Assuming they salt each password before hashing it and use a reasonable number of iterations, having relatively short password should not be a huge deal, right?

Assuming they salt each password before hashing it and use a reasonable number of iterations, having relatively short password should not be a huge deal, right? The salt means that an attacker can't just use a rainbow table attack against a single password. In the event that an attacker does get ahold of all the hashes and salts, they would still have to brute-force each individual password. Though I suppose having a maximum password length of 6 might correlate with not using other best practices, like salting the hashes...