Yeah you’re correct. The person you’re replying to is treating dictionary attacks as separate from brute forcing. Dictionary attacks are great on short passwords using likely words, but as soon as you use 2 or 3 or 4 words it becomes computationally unfeasible. I would say a completely random string of the same or much less length is more secure because a dictionary attack won’t work at all, but 3-4 word passphrases are excellent for passwords that you have to manually enter ever.