Greetings SE security community.
Background: I have a number of items like certificates, databases, and encrypted file systems that require private keys. In order to avoid having duplicates of these keys on the different systems that use them, I'd like to keep them all in a secure portable location, like an encrypted flash drive. While looking at options for hardware-encrypted flash drives, I noticed that all of them (biometric authentication-based models excluded) had relatively short maximum password/passphrase/PIN lengths. They tended to cap at 16 chars, some even lower; as I'm used to applications like TrueCrypt and KeePass (which have very high password and key length options), this seemed insecure.
Question: When using a secure element for hardware-based encryption that is actually secure and infeasible to tamper with; and assuming that feeding guesses to the device will result in destruction of the data after a very small number of incorrect attempts (e.g. 10); and that the password chosen is not easily human-guessable (a birthday, pet's name, etc); how important is it to have a password whose length and/or complexity makes it computationally infeasible to crack?
Simple Version: Does the password used to authenticate to a hardware token need to be strong, or will an adversary never be able to try cracking it anyway?