I agree. I'm going to use a 64 chars length. In fact I think the main benefit is control duplicate exploitation. I think if someone can figure there is a PHP code injected and how to use it it would be more feasible rexploit the vulnerability (assuming someone hasn't hacked and patched a wordpress awright...)