Check out the table. I believe the bottom line is, that length and symbols and all those restrictions don't add any security because the relevant threats are not password probing.
although one that cycled passwords regularly would presumably do the trick.
Though the takeaway in the article is that you really only need to check Top X and Top X may be as low as 10 assuming other mitigations are in place.
About all this article shows that is the only "complexity" test that matters is that a password shouldn't be in the Top X most used passwords, and X may be as low as 10 (much less the thousands you can easily check with Pwned Passwords) if you are attempting (distributed) password spray detection in your login systems, MFA, etc.