I am a bit skeptical about this particular claim because if you have a CC Q you should start at around 71 bits of entropy adding a three-word passphrase from a random list would add something like 39 bits of entropy totaling 110 bits which is pretty secure. I would think this person made other mistakes.