Fixing the password problem is as easy as 123456

How come it’s still possible to ‘secure’ an online account with a six-digit string?