I think you're seriously overestimating the time it takes to crack most peoples 12 character passwords.
You are right, he is grossly overstating it. I have done it in as little as three seconds. That is assuming a Brute Force attack is even the best attack strategy in the first place.
Brute Force should be the last thing you try. For DOC/PDF, etc files, in the business would, people are not programming gurus. They are going to use names or words they can easily remember. It is just a matter of having the password cracker sift through its dictionary file.