It also doesn't help that the complexity rules are inversely proportional to the importance of the application.

My former mortgage company's password requirements were 8 characters max, no special characters.

The app for scheduling appointments at my barber (no payment info) requires a minimum 12 character password with 2 or more special characters, 2 or more uppercase characters and 2 or more numbers.