Comment by kadoban

The number of iterations scales linearly with the cost of brute-forcing.

The cost scales exponentially with the length of the password, assuming a random password (stops scaling when you reach the hash size I think).

Both are important because you can't freely increase the password length, they become more annoying to enter and remember.