The password rules don't even enforce a strong password. It let me use "Password123!". It just ads friction to the signup process and protects nobody.