Why is it terrible?

Certainly a passphrase consisting of 4 English words is going to be easier to attack than a password consisting of a similar number of random letters. But as long as you judge a password or passphrase by its information content rather than by its length, xkcd-style passphrases can be just as good as random letters, but are likely to be easier to remember.

Plug: I've written a random passphrase generator, inspired by xkcd's https://xkcd.com/936/ ("correct horse battery staple") that picks random words from a dictionary, subject to requirements you can give on the command line. It optionally tells you how much randomness is contained in the generated passphrase (assuming the attacker knows the parameters you used). Sample output (picking 4 words of 6 to 8 letters):

    $ gen-passphrase -v 4 6 8
    verity nonfat shunted specking
        27405**4
        5.6405e17 possibilities, equivalent to:
        58.97 random bits
        12.55 random lowercase letters
        9.90 random mixed-case alphanumerics
        9.00 random printable ASCII characters

The reported numbers will vary depending on which dictionary you use (/usr/share/dict/words by default). In this case, the dictionary contained 27405 words of 6 to 8 letters.

https://github.com/Keith-S-Thompson/random-passwords

Of course this won't work for sites that restrict the length of a password, or that require special characters.