Are there actually any genuine, legitimate people who offer the brute force service for commission?
The only one I am aware of is Dave from Wallet Recovery Services. His account and link to his website are here:
https://bitcointalk.org/index.php?action=profile;u=130960. I've never used them myself, but they have been around for many years, have some positive feedback, and I am not aware of any scam accusations against them, so that's probably the best you will find. Having said that, he still cannot brute force a difficult password from scratch with nothing to go on, and will start from the same basis that you have started from with a known word and unknown symbols following it.
Can I just check you were running
--listpass just as a test, and not including it as an option in your actual brute force attempt?
--listpass simply makes btcrecover print the possible password combinations on screen as opposed to actually try them against your wallet file. See here for its usage:
https://btcrecover.readthedocs.io/en/latest/TUTORIAL/#testing-your-configI'm more than happy to help you tweak either your tokens file or command line prompt if your initial search is unsuccessful.