I don’t see this as even remotely “evening out” the parent comment. If a site mandates strong passwords, it is more likely to follow other best practices like

I don’t see this as even remotely “evening out” the parent comment. If a site mandates strong passwords, it is more likely to follow other best practices like throttling login attempts and locking accounts after too many failed attempts (either per account or per IP). If attackers target the site, they should only have a limited number of attempts before they start getting thwarted. It would take a lot of attempts (exact numbers will vary) just to determine if a given user’s credentials are strong or not, so the adversary has already wasted significant effort on the accounts they will eventually “move on” from. If the site has throttling and/ or account lockout, the adversary should not be able to determine who has weak versus strong passwords.