That could well be it. My bank enforces similar short passwords, but they're not such a big security risk since they lock the account after three mistakes, and require you to visit a branch in person to reactivate it.

I guess that means they're wide open to denial of service attacks, but that's another story.