There might be something wrong with your site in general as it would seam setting by reference does not work for you. To use reference variables your site has to allow for eval or create_function otherwise it won't be able to pass reference variables. Often people will add eval to disabled_functions, but that won't actually disable it although CB Auto Actions will respect it. It can only actually be disabled using suhosin, which CB Auto Actions again will respect. If you're on PHP 7.2+ then create_function no longer exists. So if both are disabled then reference variables will not work and you won't be able to use this feature to change the length and you'll instead have to replace the password entirely by returning a new randomly generated password. The below might work for that.
Global
Triggers: onUserRandomPassword
Type: Code
User: Automatic
Access: Everybody
Action
Method: PHP
Code:
Code:
jimport( 'joomla.plugin.helper' );
return JUserHelper::genRandomPassword( 6 );
Output
Display: return
Have added a feature ticket to add under the reference variables parameter a warning if both eval and create_function are not available.