You are right, the explanation is glossed over.

Perhaps because it is so simple: what matters for passwords is length. No other complexity metric (codeset, whatever) is even in the same race.

Personally, my passphrases are seven words or more, which gets me to over 30 characters.