Has anyone got direct, first hand experience with such a thing? I'm wondering if it's become urban legend. I've inherited several ancient code bases where ever

Has anyone got direct, first hand experience with such a thing? I'm wondering if it's become urban legend. I've inherited several ancient code bases where everyone knew silly password rules were a legacy requirement. And ultimately after a lot of digging, every time they were a "legacy limitation" because the original project manager called for it, and could easily be removed by commenting out one check. Which was never allowed to happen, because it was a "constraint that couldn't be changed". I do accept there are databases with eight character fields for maximums, but beyond that, I'm interested in any genuine experience.