When it started a 5 word list was recommended. Now a 7 word list is recommended.
Imagine a word list where all the words are lower case, and don't use any special characters. And our passphrase has 7 words, each separated by a single space, with no extra special characters or numbers. And also our attacker knows our wordlist and our passphrase rules.
We have a phrase that is one of 7776^7 different phrases. This list is too long for a dictionary attack.
It's really weak if we have 4 words or less.
Ideally you'd have a long strong passphrase to open a password safe.
It'd be great if people could invent really good tokens instead of passwords.