It isn’t so much what Discourse uses for passwords, so much as what users use for passwords. The overwhelming majority of users, left to their own devices, will use lowercase letters and numbers (if you’re lucky), thus if you’re going to be iteratively brute-forcing a password, that’s where you’ll start. Dictionary-based brute-forcing is a different problem: there, it’s a matter of “if the password is on the list, you’re toast, otherwise you’re fine”. Thus, against a dictionary brute-force tool, there could very easily be an 8-character (or even shorter!) password that is secure, while a very long and otherwise complicated password would be compromised if it happened to have gotten onto the list of passwords to try for the specific attacker at issue.
That makes me wonder if anyone’s put together something like a bloom filter dataset of “all known passwords”, perhaps with a certain minimum length (because iterative brute-forcing of short passwords is, indeed, trivial). A bloom filter would be far, far more efficient, space- and search-time-wise, than a static list, and it would allow you to block every password ever known to have ended up on a dictionary list somewhere.
Remember, kids: there ain’t no kill like overkill…