I used the CoinMarketCap API to pull down a list of all registered currencies and assets (so not just ERC-20 tokens... ), and fed it into a quick Python script to count the number of occurrences of symbols of different lengths.
import urllib, json
from collections import Counter
url = "https://api.coinmarketcap.com/v1/ticker/"
response = urllib.urlopen(url)
data = json.loads(response.read())
counts = Counter([len(asset['symbol']) for asset in data])
for i, j in sorted(counts.items()):
print("Asset symbols of length %d: %d" % (i, j))
Gives the following counts:
Asset symbols of length 1: 3
Asset symbols of length 2: 35
Asset symbols of length 3: 639
Asset symbols of length 4: 273
Asset symbols of length 5: 121
Asset symbols of length 6: 18
Asset symbols of length 7: 2
Asset symbols of length 8: 4
Asset symbols of length 9: 3
So while the most common length is 3, you're probably good for longer lengths. Of course, different exchanges and websites may format their UIs differently...
Edit:
I was reminded of this thread by a newly posted question. (Naming conventions for ERC-20 instancies)
Running the script again, just for fun, as of 28 Nov 2017:
Asset symbols of length 1: 3
Asset symbols of length 2: 37
Asset symbols of length 3: 768
Asset symbols of length 4: 350
Asset symbols of length 5: 143
Asset symbols of length 6: 17
Asset symbols of length 7: 4
Asset symbols of length 8: 2
Asset symbols of length 9: 1