While it definitely raises some good point on password security, hasn't the essential vulnerability always been SQL injection with most CMS platforms? Even the best password isn't going to do much when they inject a new user with their own credentials, unfortunately..