We use six for anything related to an external system or third party (with multi factor where available), and these are password managed behind the same four word pass, plus multifactor.

I'm assuming they stuck with four to make them memorable by actually humans. Even then I have my moments where I type in an adjective form instead of a noun for a particular word/variant.