I think brute force password crackers could be made much more efficient by using machine learning or manually written rules to exploit how people choose passwords.

Even if you force users to pick a password of at least 8 characters with upper and lower case letter, numbers and special characters, I suspect the real entropy is much lower than the theoretical.