Because of composition rules. Fewer characters, much easier to brute force guess.

So when a site tells you ‘Your password must be at least 6 characters long’, and they just want to get past it to get to the content, the number is already on their mind.