I think you're right. Reported on Syncthing forum. https://forum.syncthing.net/t/entropy-of-untrusted-device-sc...
> In the sense that someone could easier pre-brute-force all passwords for that specific folder ID, yes.
That's the definition of a rainbow table, and a fixed, known folder ID makes the "salt" effectively worthless.