You are mostly right but still, it does not mean it is impossible.
Even with a very long complicated password, someone could have luck to crack it.

The sure way is mining/stalking (and don't forget about the electricity costs).
The lucky way is cracking a password

Still, I am on your side because the majority of the wallets shared here are fake.