One of the things I used to hear cited "back in the day" was that things like the SAM file from a DC took about a month to crack so you should rotate passwords

One of the things I used to hear cited "back in the day" was that things like the SAM file from a DC took about a month to crack so you should rotate passwords on a frequency that beats that race. But it's always struck me as an awful lot of burden to put on to your users for a rather low likelihood attack surface. These days though it makes even less sense.