The real security depends not only on the length and complexity of the password but also strongly on the used hashing algorithm and other measures like rate limits. Strongly focussing only on the password requirements is a bit short-eyed. Other factors like usability needs to be considered, too. I hope the still to published article consider this.
If modern algorithms like from the argon2 family are used with high workload settings, even shorter passwords could be safe if done properly.
Nevertheless, it is probably true that only very few follows current best practices.