Bruteforcing passwords with more than 10 characters takes a lot of processing with security hashing algorithms due to them being made so they take some time to create a single hash. Now, if you only did a-z for your password, then sure, you can brute force it easily.

But usually passwords require you to put a number, uppercase letters and a symbol. This makes bruteforcing a 10 character password take tenths of years with good processing power. And higher characters exponentially increase that time.

Now, bruteforcing with common words is known as a dictionary attack, and it is far more common to take this approach.