The problem is ultimately that the randomness of a brain wallet is only as good as the randomness of the underlying passphrase i.e. terrible. Humans are not good at making random passphrases, and so the search space for an attacker is massively reduced. Instead of searching through every possibility, using a dictionary to search for common words, etc. would likely lead to cracking the wallet relatively quickly.

Is this better than a single iteration of sha256? Probably. Is this a secure key derivation function in any way? Absolutely not.