The intent of the policy doesn't match the real-world implementation of users. Users are lazy. Users will alter a single character or digit in the password and call it changed.
Most people don't use password managers, and some companies block their usage. Now add a requirement of a "secure" password.
