I agree that having a longer or shorter username should not be a point for making your account more or less secure. That's what the password or any other proof of identity should be doing. The username is just a way of addressing you and it's totally public.
The only requirement is that it be unambiguous - you can't have two people using the same username.
I will say that there's probably a value to starting the number of required characters at some minimum limit as a way of resolving contention over very short, very easy to remember usernames. Forcing everyone to go with at least 6 characters is a good way to keep users trying to set up their usernames from thrashing through all possible < 6 character options only to find that all of the have been taken. Cutting down the frustrated users is a big deal on a large scale system like Google - which is also why you see suggested usernames to help you try to find something that's available that you can live with.
I'd believe them when they say that spam is an issue on short usernames - the smaller the address space, the easier it is to cover, and I would not be surprised to find that spammers can cover the < 6 character username space pretty efficiently. I'm not sure I believe the "it's for your own good" line - I think it's for Google's own good. If they can simply deny ALL email that comes in for a username that is less than 6 characters, that's a nice chunk of traffic to be able to flat out deny without further matching needed. The more clever your spam filters, the more resources they can take to execute, so being able to flat out deny any chunk of your username space has got to be a win.
I'd agree that in a small userbase - like a private domain or a small company - it's probably less valuable as you have neither the large size user base nor the huge level of traffic/storage requirements of a social networking site.