That might be true for the password on a .zip file where you can write a program to brute-force trying passwords until it gets it right.

For internet passwords, it is not correct. To begin with, no competently programmed system would allow a user to check random passwords at full speed forever. Most would block the user account after a handful of failed tries, and even before they do that, they force a delay before answering, so testing 100 passwords would take a whole day even if you bypass the account blocking.

The most common way to steal passwords is to create websites where you require the email address to register, and hope people are stupid enough to use the same password in the website as they use on their email address they used to register. (You’d be amazed how many people do just that.)

Also it’s common to use fake “login using your Facebook account” so people give their Facebook/Twitter username and password to random websites.