You don't want your product to be the one with hundreds of people having their accounts compromised. This warrants a bare minimum of password requirements.