I expect most businesses have already made significant resource allocation decisions for work in 2019 so introducing previously unaccounted for work would be seen as "anti-business".
Because it takes businesses 2 years to requiring passwords that are 8-14 characters, include punctuation, capitalization, and numbers.