Defaults matter. There’s a huge difference between starting an account with a complex password and then the user intentionally weakens it, vs starting with a we

Defaults matter. There’s a huge difference between starting an account with a complex password and then the user intentionally weakens it, vs starting with a weak password with a note saying “pretty please change it”. It’s obvious that some set of users will not change it, so it’s better to start in a default secure state than an insecure one. And yes, sometimes security and UX conflict, and users just need to deal with it.