By default, it uses a dash "-" as separator. I was mucking around with different settings when I discovered it. It also uses 4 words by default and I changed it to 5. Funnily enough, I read a few articles that specifically suggested 4 words is fine but 5 is ideal.

Depends on the application. For an online login account, 4 might be enough (not used for anything other than login, eg, not using the same password for encrypting your data in the backend). The are rate limits and brute force blockers (though sometimes those feature can be bypassed).

For file or disk encryption? Absolutely not. Use 10 words minimum (it depends on the word list, but 10 is a safe bet across the board).

> If Bitwarden default is not safe, the software should not be used.

The definition of "safe" depends on your risk model; what is appropriate for people named Snowden is not necessarily appropriate for many others.