I'd suggest that users who care , when no longer forced to periodically rotate passwords, will likely choose better passwords (I know I have, where I'm no longe

I'd suggest that users who care , when no longer forced to periodically rotate passwords, will likely choose better passwords (I know I have, where I'm no longer required to do so). Users who don't care will still choose bad passwords, this is why 2FA is important :) Forced periodic password rotation was mainly security theatre. Most users just choose sequence passwords, so an attacker who gets one can easily work out the others. If you then take counter-measures to stop obvious sequences, you're heading into seriously user-unfriendly password policies, which is the kind of thing that gives security a bad name. Far better to make use of 2FA at that point.