How easy would it be to crack a AES-256 encrypted file, that is protected by a passphrase?

I understand that the trying to brute force a AES-256 encryption key would be on the unfeasible side, even with quantum computing. But what if that encryption key was instead generated from a passphrase? How easy would it then be to break the encryption?

I'm not experienced at all in cryptography, but tried making some simple estimations:
According to the Oxford dictionary there are around 170 thousand english words in use. Of course, only a fraction of these are frequently used passwords, but let's use this number.

If we tried to brute force the passphrase, I suppose we'd start with 1-word long passphrases, followed by 2-word long and so on. Assuming the words are not repeated, this would give a total number of possibilities :

$N(L) = \sum\_{i=1}^L \frac{170000!}{i!}$

Where L is the maximum passphrase length (number of words) we want to try to crack.

In order to get a number of permutations of around $2^{256}$, then we'd need a passphrase of at least 18 words, given that $N(15) = 2.85\times10^{78} = 2^{260}$.

Is it then correct to assume that, if the attacked knows the "password" is indeed a passphrase made up of english keys, then the passphrase needs to be at least 15-word long in order for it not to be the weaker link in the AES encryption scheme?