This is simply not true and shows you have no idea about what you are talking about. You are just embarrassing yourself at this point.
- Nimiq is completely client-side and non-custodial so your information (encrypted keys) are stored only in your device, like MyEtherWallet does. Do you also have a problem with them?
- Users have multiple ways to interact with the Blockchain, Nimiq Safe is just one option provided by Team Nimiq. If you are concerned about security you can always run a Nimiq Full Node, it's very easy with Docker.
- The minimum character count on Nimiq passwords is 8, not 6. There are numerous client-side checks done on the password to help the user be secure (like avoiding 12345678 and such).
- Users are welcome to choose a longer password but for usability-sake 8 characters safe enough considering the file encrypted by the password is only stored in your device.

So much buzz here about this shitcoin. The beauty of this shitcoin is that they can install at any given time a honeypot js script (1 line of code) to sniff all private keys used in browser by users and crack them in a few minutes as the password is really weak ( 6 letters ) by default. What a fucking joke. This is exactly how you would make a blockchain insecure, just like Nimiq.