We should be able to at least estimate an upper bound. If wikipedia has 2.5B words, let's generously assume 10B words. Let's allow phrase lengths of 1-10 words

We should be able to at least estimate an upper bound. If wikipedia has 2.5B words, let's generously assume 10B words. Let's allow phrase lengths of 1-10 words and arrive at 100B combinations. Optimistically we're at 37 bits, not even a 7 character [a-zA-Z0-9!@#$%^&()]. And unlike the [a-zA-Z0-9!@#$%^&*()], we could madly cut that down based on frequency and popularity. Therefore existing phrase passwords are security through minority. If they are adopted, they provide at best an order of magnitude or two over simple dictionary words. But we're kidding ourselves, most people still use 'password'.