Re: The Usual Response...
"If it is commonly used words that you are likely to remember, then isn't it a lot less than that."
Or it might be a lot more. Merriam-Webster lists nearly 500,000 words, and apparently some counts put it at over 1 million. Even that 171k is only those listed as in common usage, the OED actually contains around 230k. Plus dictionaries generally don't include proper nouns, so there's a huge additional pool as soon as you start using names. The thing is, the exact number really doesn't matter. All that's important is that there are a lot more words than there are characters (that is the entire point of an alphabet after all) and that it's generally easier to remember longer combinations of them. Even if you assume people only use their own vocabulary and don't look anything up or use a generator, that's around 30,000 common words, and a random selection of four of them provides about the same number of possible combinations as 10 random characters.
Essentially, there are two main factors involved in creating a strong password - length and character set. If you consider your character set to be actual single characters, you're limiting yourself to a few tens - basic alphanumeric gets you 36, adding cases and punctuation can push you up to maybe 100 at most. That means in order to get a strong password you need to make it long, and as this article shows the traditional 8 characters that still serves as a limit in many places simply isn't adequate.
If you instead you use whole words as your character set, you're looking at orders of magnitude larger - around 30,000 for the average person's working vocabulary, potentially into the millions using dictionaries, names, slang, and other languages. With your working character set orders of magnitude larger, a password doesn't need to be as long - four words being about equivalent to a reasonable strength password made of random characters. Quibbling over exactly how much bigger the character set is just doesn't matter. Maybe it's only 20,000, maybe it's a million. Maybe you need 5 words instead of just 4, maybe even 3 is good enough. It's the qualitative difference that's matters; as long as your working character set is orders of magnitude larger, exactly how many orders of magnitude just isn't that important.