Why is SHA256/SHA512 not broken for shortish passwords
SHA-256 and SHA-512 were designed to be very fast. Their primary goal ist to verify the integrity of long messages or files. Long means not 10-12 bytes but some megabytes and greater. It is not a good idea, to use hash function that is fast by design for password hashing. Instead, for password hashing should be used functions that need essentially more resources for brute-forcing, e.g. that require relatively much RAM, prevent or limit essentially parallelization and thus limit optimization of brute-forcing. For instance, Argon2, Lyra2, scrypt.
Compare it to cars. Ferrari is good for the cases when the speed is important. It is not correct to say that Ferrari is weak because it cannot carry big load. If you need to move a big load, you better use huge trucks. It is just a matter of choosing a proper tool for the task.