Hacker News Reader

I think the question is do people naturally change old passwords without such policies.

The policies are the problem and the industry has recognized it so they’ve moved away from those recommendations.

Yes, this basically. Sure if you have to change your password you will, but if there is nothing compelling you to do so why do it? And if yes, why.