Forcing password expiration does cause people to make shittier passwords. But when their passwords are breached programitically or through social engineering They don’t just sit around valid for years on the dark web waiting for someone to buy them up.