Pretty bad indeed, but then again: this is a master password you're setting. The one password to rule them all ought to be strong anyway. If you do that, it's perfectly safe.
"I eventually found the sftkdb_passwordToKey() function that converts a [website] password into an encryption key by means of applying SHA-1 hashing to a string consisting of a random salt and your actual master password."
The problem is that each year definition of "strong password" changes, because of growing performance of CPUs and GPUs.
"Use a password manager" is always a good solution, I know. But well, who will remember the super lengthy password for the password manager? ;)
His "solution" is to use shorter passwords. The XKCD method is good if you add separators, padding, etc; as expressed featured on xkpasswd.net
I highly recommend generating a password and then adding something unique to it.
For instance, a password I might generate would be:
$66=mine=BODY=spot=STOP=23$-d1j1t
It's memorable enough, and I highly doubt it's easily crackable. Certainly no less than 'tlpw2m'.
However, as you point out, it provides no argument against passphrases, aside from referring to them as a "trick". I still don't know how people look at the XKCD explanation (where Randall Munroe actually does a pretty good job of correctly and succinctly detailing the strength of the two password styles [1]), and call it a trick. The only trick is that your mind has an easier time remembering passphrases than it does remembering a similar strength random string.
[1] Specifically, Randall already assumes that the cracker knows that the password is a passphrase, and has the 1000-word list it was picked from.
You still definitely have to accept at least four words actually randomly generated (this is important, else the scheme falls apart horribly). Accepting 6 random words is pretty secure IMHO.
https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...
Most (all?) places that discover that 9+ is not good enough for the most valuable credentials, move to 2FA instead.
Luckily, you can change your password.
Also, you could say the same thing for the hashing algorithm. Every year you'd want to up your iteration count or even upgrade algos (e.g. use memory-hardness when scrypt was released).
It works both ways, but overestimating is never a bad idea: if someone hacks you now and cracks it in five years, some passwords may still be in use.