I would argue that many people also use very simple encryption passwords out of convenience because of the frequency they need to decrypt their machine.
Yeah, agreed.
I use whole disk encryption on all my devices. The decryption key for my laptop which I use day-to-day for emails, work, etc. but not for my crypto wallets is around 100 bits of entropy, because as you say I have to enter it probably 5-10 times a day. The decryption key for my airgapped device which I store my cold wallets on is just short of 300 bits of entropy, because I wanted it to be at least as secure as a 24 word seed phrase. I only have to enter this maybe once a month, if that.
It really comes down to balancing security vs convenience. it is also a balance of security vs being able to memorize your password. If you have a complex password full of entropy, that is great and all, but it kinda defeats the point if you can't decrypt it because you forgot your passphrase.
I know that I'm an outlier here though. I also know from experience in my workplace that people are horrendous when it comes to password security. Same password for everything, names of their spouse, family members, or pets (or even their own name!), passwords written down in their notebooks, even passwords written on the underside of keyboards. I would be hopeful that if someone is technical enough to be using whole disk encryption they are also smart enough to be using long random passwords, though.
In many companies, writing passwords down as you describe would be a 'clean desk' violation. Many companies also utilize some kind of Single Sign On technology that allows employees to use a single username/password combination across (nearly) all services requiring authentication; in these cases, all the applications are run by the same company, so the risk of 'one' password leaking is not the same as it in normally, and companies usually keep track of unsuccessful login attempts, and will lock accounts upon a small number of attempts. Using a weak password to a service or application is bad, but not the same as having a weak encryption key.
Back on topic....if your device holding coin is subject to a physical attack, I would suggest you consider it to be eventually compromised. If this is part of your threat model, you should create countermeasures that involve you discovering, or being notified of the physical attack quickly, and use other countermeasures that delays the time from the physical compromise to the compromise of the keys.
It bears repeating that a trezor allows you to have multiple passphrases, so you can have a simple of moderately complex passphrase securing a low to moderate amount of coin. If any attacker physically steals your trezor, and can discover your simple passphrase, they need to make a decision if they want to continue looking for an additional passphrase, and if they want to spend the coin they have discovered. You can monitor the coin being secured by the simple passphrase, and if this coin moves, you can move the coin being secured via a more complex passphrase.
I wonder if it is even technically possible for Trezor to enforce passphrases by default in their wallet? The passphrase functionality is currently "hidden" in the advanced settings once you get the wallet setup and I believe it actually sets a flag within the device so that the web interface asks for a passphrase during wallet unlocking.
No, it is not. They could enable it by default, or prevent it from being disabled. None of this would prevent someone from using a blank passphrase, or a very simple one such as
zzzz
