No one would even assume that someone chose a single character. People with bad intentions would start at with a minimum of 4 or 6 characters?

This way, in case of just bruteforcing your way in, you are indeed very safe. They would brute force into infinity...