Edit: Ars Technica had a piece a while back on crackers and how they build their lists of probable passwords. I imagine if Dvorak-based passwords became common, they wouldn't last long as "secure" before appearing in those lists.

Edit: The Ars link follows. You'll notice that the password in the story title is a keyboard walk, which the writer confuses as being complex, when it is not: http://arstechnica.com/security/2013/05/how-crackers-make-mi...