But the brainwallet could also have been generated from a concatenation of the 8 words and the 13+ symbols password, which makes a lot of sense to increase entropy with the added password.
I wrote him the same thing a long time ago.
There could be a program or a web page that first asks you to enter a list of words to remember.
Then a separate field for entering a password.
Individual fields could be there to make it easier for the user to understand or better remember the information.
But the logic of the code could be simple: seed = SHA256(words+password)