I used the CoinMarketCap [API][1] to pull down a list of all registered currencies and assets (so not just ERC-20 tokens... ), and fed it into a quick Python script to count the number of occurrences of symbols of different lengths.

    import urllib, json
    from collections import Counter
    
    url = "https://api.coinmarketcap.com/v1/ticker/"
    response = urllib.urlopen(url)
    data = json.loads(response.read())
    
    counts = Counter([len(asset['symbol']) for asset in data])
    for i, j in sorted(counts.items()):
        print("Asset symbols of length %d: %d" % (i, j))

Gives the following counts:

    Asset symbols of length 1: 3
    Asset symbols of length 2: 35
    Asset symbols of length 3: 639
    Asset symbols of length 4: 273
    Asset symbols of length 5: 121
    Asset symbols of length 6: 18
    Asset symbols of length 7: 2
    Asset symbols of length 8: 4
    Asset symbols of length 9: 3

So while the most common length *is* 3, you're probably good for longer lengths. Of course, different exchanges and websites may format their UIs differently...

**Edit:**

I was reminded of this thread by a newly posted question. (https://ethereum.stackexchange.com/questions/31916/naming-conventions-for-erc-20-instancies)

Running the script again, just for fun, as of 28 Nov 2017:

    Asset symbols of length 1: 3
    Asset symbols of length 2: 37
    Asset symbols of length 3: 768
    Asset symbols of length 4: 350
    Asset symbols of length 5: 143
    Asset symbols of length 6: 17
    Asset symbols of length 7: 4
    Asset symbols of length 8: 2
    Asset symbols of length 9: 1

  [1]: https://coinmarketcap.com/api/