What I don't understand is why don't they use the hash function millions of times to make their brain wallet even more secure?
It has to do with the time consumption. When the user enters a password they want to get their address as soon as possible, if you increase the number of hashes it would consume more time hence ruins user experience. And considering that brainwallets that I've seen are browser based they are even more limited to the amount of computing power they can use so the process could be even slower than it could be.