Most of the high security sites that are on the net are not on C class operating systems, plus those guys have air gaps and all kinds of fancy equipment. Most of the time though its default configurations or default backdoors and worms that create backdoors for people, if the people weren't involved though then their stuff could be pretty secure.
Most of the times its just little screw ups, not neccessarily just a 10 digit key. Lets see, there are devices that AOL uses on thier own networks that generate a passkey that changes every 2 minutes, where 2 sets of these keys are needed to access something, similar to the theory of 2 keys having to be turned at the SAME time to access a vault. There is all kinds of cool stuff out there, its just screw ups most of the time that let these people in, and social engineering. "Hey this is Paul down in engineering, whats the number on that box u pthere? I'm kind of in a hurry, have to do something for the boss YESTERDAY..."
On NT4 you can lock out an account after 3 invalid attempts, so you also have simple stuff like that. If a password is going to be gotten its more likely to be sniffed/intercepted than "cracked".