Banks also lock the accounts after 3 failed attempts though. The short passwords are to avoid having to deal with phone calls that go something like, "Hello, I forgot my password."

Overlooking 6 characters vs 20 over a shoulder is must easier though.