A bit of late response but I do I a few things to add:
I'm been playing PVP games for a while and can confirm that the vanilla reach in survival with perfect ping is 3 blocks. However, in versions 1.8.9 and below it's possible to do something called combo locking where even if both players have 0 ping and perfect aim, you can consistently hit your opponent before they can hit you for in crazy combos. As @Penguin said, This is because if you get the first hit, the upward knockback forces the opponent into a higher y-level, making the distance from your opponent's head and you longer than the distance between your head and the opponent, because the base of a right triangle is shorter than the hypotenuse.
This means the reach of both players is the same, but the distance that it takes to hit each other is unequal. Combo locking is best performed with Speed II and sprint resetting in order to minimize the amount of time that the opponent's reach distance is within 3 blocks. Sweaty players who know these mechanics and use them may seem like they're cheating with reach hacks from their opponent's point of view.
Another factor that impacts reach is ping: If your ping is somewhat on the higher end, you can occasionally hit opponents while they're outside the usual reach distance of 3 blocks. This is because you're sending and receiving delayed packets from the server. The first hit deals knockback to the player, and while the server still hasn't sent you their movement packets, you can hit them again. They're outside reach distance server-side, but client-side they are still within reach. On servers with a heavier anticheat, players with lower ping will benefit instead due to their hit registration being better.
In any case, without plugins, it would be extremely rare to get a hit above 4 blocks. Six block reach is either extremely bad lag or cheats. Usually on a server, players will get 3 block reach on the first hit and a variation of 2-4 blocks during exchanges.
Edit: I just remembered that cheat clients have a maximum reach of 6 blocks without tp aura. So maybe Minecraft has a built-in reach limit of 6 blocks that can't be achieved in vanilla but only with cheat clients, which may explain why some people say server-side is 6 and client-side is 3.