My wife works for the govt and says the password rules also require being changed every 90 days for her, which has been proven to cause weak passwords and/or people writing them down because they can’t remember their current one.
The govt uses pretty antiquated password security guidelines, this article is no surprise.