There is the mathematical aspect which will change depending on the number of characters used and the number you can choose from. This can be calculated for any specific password for any specific system to get part of your answer.
More importantly. For people who look at password dumps on a regular basis (penetration testers as well as a number of other security professionals), we see the patterns and know what the next likely pattern will be. For example when I see the following:
user: [email protected] password: LoveMyJob6
I'm almost always going to assume that the 6 at the end represents her incrementing a number because she's had to change a password several times. Likewise you can imagine what I'd guess her next couple of passwords are likely to be:
As a penetration tester, and presumably as an attacker, yes I'm absolutely going to take this into consideration and try these first. This is just one pattern but there are many patterns that are similar. If you spend some time looking at password dumps that have been made public on sites like pastebin.com you'll start to see these yourself. You'll also be horrified at how bad a lot of passwords actually are.
Back to your question, if I'm looking to gain access to a company and have several accounts I'm also going to try to gain access to at least one account as fast as I can so yes I'm going to run all the accounts for (target organization) that I have first using the exact password I find first (because it's quick and easy to load a list like that into a tool like Hydra. After than then I'll look at variations of the current passwords, then top 1000 passwords, then look for similar words the user has on personal sites or from the industry or company website. There are other things like if the old password is a word in another language like German. I may immediately load up a German dictionary or the top 500 German words used as passwords.
Ultimately human choice isn't random so from an attackers perspective attacking the human pattern is much faster than attacking by brute-force. So yes attackers, and penetration testers, are going to go that route as far as I can.
Referencing your specific question about "supersecret11 to s.upersecret11"
to me this is a small change to a pass phrase and not the equivalent of changing the entire passphrase. Mind you, yes, I'd have tried supersecret12 or something else first, but If I saw another account where the same user had also lost another password such as l.esssecret11 then I'll immediately go back and try variations than look similar.
It is tricky to measure this but since a large part of the passphrase was left unchanged I wouldn't consider it the same as changing the entire passphrase.