Facebook does do this, and it's perfectly fine: https://security.stackexchange.com/a/214815

It exchanges a few bits of entropy for a much smoother user experience, and it doesn't actually aid an attacker much (they could just try the permutations themselves)