If the attacker search for your password specifically then xkcd themself posted the reason why it wouldn’t really matter
https://www.explainxkcd.com/wiki/index.php/538:_Security
If you’re doing blind attemps on a large set of users you’ll aim for the least secured password first, dictionary words and known strings.
I consider open source software to be community owned/maintained so I never liked the idea of selling the software. It makes much more sense to my eyes to sell services surrounding the software be it support, customizations, or even hosted services.
I can’t really get over selling a “license” for a software that is expected to still be maintained by unpaid contributors. Especially under an AGPL license where any licensing changes has to be approved by every contributors.