That math challenge assumes that the attacker will want to try all keys.

In reality, they are going to run rockyou.txt against it and just move on if that isn't sufficient.