Does anyone actually have data showing that frequent password changes lead to better security? Because to me requiring frequent password change seems like the

Does anyone actually have data showing that frequent password changes lead to better security? Because to me requiring frequent password change seems like the ultimate non-technical management blunder: management wants to say they did something to prevent hacks, so they ask IT to require password changes; IT doesn't want to be blamed so they implement it; users comply with the requirements but can't remember their new password (and don't really care about the company's security in the first place), so they come up with something insecure and keep it somewhere even less secure.