Agreed. It's also worth noting that the dataset does not represent the general population, but only the people who use 4-digit passwords on some websites.