You are more than a hundred percent correct in the real world. At that night, I just finished the crash-recovery part of the key searcher, and tested it on an SGI box using 64-bit counter. Though the speed was in fact far from 32-bit per second, I just dreamed how it was possible if something somewhere somehow. The key algorithm is the popular SHA series, which costs much more than MD series, let alone XOR ...
Well, brute attack is generally the last resort if all other cryptoanalyses failed. I am going to arrange a less expensive dictionary test, or length-limited phrase guess, though it is less than fifty percent possible to find something.