Why does this whitepaper say MQTT usernames/passwords "do not provide enough entropy"?

Question

This whitepaper comparing MQTT and AMQP says that MQTT's username/password restrictions make it far less secure than AMQP:

MQTT requires short user names and short passwords that do not provide enough entropy in the modern world.

Section 3.1.3.5 of the MQTT specification says that passwords can be up to 65535 bytes of binary data. A quick calculation shows that this produces a ludicrously large number:

To put that into scale, if you could try one hundred trillion passwords a second, it would take approximately 1 x 10¹⁴ million years to exhaust the search space of any password between 1 and 65535 bytes.

Therefore, I can only assume that the author is either incorrect, or that they were talking about a restriction that occurred previously but has now been lifted.

Why would the author of that whitepaper say MQTT's passwords have insufficient entropy, and is it still the case, or are my calculations correct?

Answer 1

Version 3.1 of the spec suggested some unreasonably low username/password lengths:

It is recommended that user names are kept to 12 characters or fewer, but it is not required.

It is recommended that passwords are kept to 12 characters or fewer, but it is not required.

I imagine that any sensible broker didn't implement this recommendation.