This whitepaper comparing MQTT and AMQP says that MQTT's username/password restrictions make it far less secure than AMQP:
MQTT requires short user names and short passwords that do not provide enough entropy in the modern world.
To put that into scale, if you could try one hundred trillion passwords a second, it would take approximately 1 x 1014 million years to exhaust the search space of any password between 1 and 65535 bytes.
Therefore, I can only assume that the author is either incorrect, or that they were talking about a restriction that occurred previously but has now been lifted.
Why would the author of that whitepaper say MQTT's passwords have insufficient entropy, and is it still the case, or are my calculations correct?