Comment by kasey_junk

I think the question is do people naturally change old passwords without such policies.

The policies are the problem and the industry has recognized it so they’ve moved away from those recommendations.