That's not always true. For example, imagine if someone compromises one of your backups. Some hard drives were stolen from the office or something. In there yo

That's not always true. For example, imagine if someone compromises one of your backups. Some hard drives were stolen from the office or something. In there you had your password written in a text file ( because you're that kind of person). The attacker still doesn't have access to your computer. But they do have access to your password from the time of backup. A disgruntled employee remembers the password of a former coworker. At one point the password will change, so the window of opportunity is smaller. It's not perfect, obviously, but in a lot of office environments passwords are easy to gleam. Another argument for password rotation: it usually forces people to keep different passwords per service. Without rotation, people tend to use the same password for everything There's a trade-off, but it doesn't accomplish nothing