The missleading thing about passphrases is that anything a human can remember is low entropy. That it has 20 charachers says nothing about how random.

Edit: I also wonder how much randomness is really needed. Properly salted and hashed passwords shoud not need that much randomness. Lot of this is about users just choosing bad passwords, reusing, and IT not properly salting and hashingon their end.