Yes. As I said in my first comment on this subject sentence structure is part of it. Random words with no context are stronger than sentences. There a reason why your example clocks at 4 million years and the first example was only 3 hours.
At https://pmdn.org/password-strength/
There’s plenty of common sites like national banks. I have no idea if you bank at Chase, WellsFargo, etc. It’s trivial to check. I have your email address and username. This is what bots are used for.
thisismyverysafeunguessablepassword = centuries with offline fast
Yes and no. One thing you are forgetting is that websites generally don't let you pound away at them by trying a brute-force attack. You get from 3-10 attempts on most sites before being locked out. Some lockouts are timed pauses others are locked out until you contact the owners by phone and get a password reset. This limits the ability to attack sites. Of course, with a password manager or any encrypted blob if hackers gain possession of the blob they have unlimited time to work on it. A rack of 10 GPUs can easily process billions of attempts. That is not cheap but it's not an unreachable goal either. Botnets obviously cost nothing for the hackers to employ though development and deployment will have some expenses and takes time.
Conventional wisdom involving complexity does help, but it doesn't replace for length. Longer passwords provide entropy through length, and the strength of it is directly attached to the algorithm that's doing the hashing. But a string of words, even if they're a sentence, separated by a special character, and a number tossed in somewhere can create memorable, easy to communicate, easy to type passwords.
Banks are very slowly getting smarter. None of my banks use email address as the userID. That wasn't the case 5 years ago. They still limit the password complexity too much, but baby steps, I guess. My main business bank, in fact, has two separate ID numbers you input as well as a password...
