Online brute force basically doesn't happen and can be managed by sane traffic filtering.
It does make passwords weaker. But 26^8 is still 200B. People aren't making 100B login attempts to break your case-insensitive alphabet-only eight character password.