I have always used long passphrases for my own Windows user accounts. But I know some people who use moderately common passwords (we'll say they're in the top 1,000 most used passwords, but not in the top 100).
From Why do we lock our computers?, I see that locking protects you from attackers who are unskilled or not prepared, and can even slow down prepared attackers for a few minutes. But if a capable attacker is alone with your computer for any extended period of time, they can get in if you don't have full-disk encryption.
Does it make sense to use a strong account password (that is, something not in any password list)? Nobody is going to try the top 1,000 passwords if they're alone with your computer for a few minutes, and if they're with your computer for longer than that they can use other means.
Suppose RDP is disabled on the computer and the administrator account has a lengthy, unique passphrase. We'll also suppose that the user's password is not one they use elsewhere. Is there any attack that becomes easier if a non-administrator user password is in a list of common passwords?