I don't understand the mental leap here to blame password rotation on Microsoft specifically. Shouldn't that blame be aimed at (older) NIST and (current) PCI DS

I don't understand the mental leap here to blame password rotation on Microsoft specifically. Shouldn't that blame be aimed at (older) NIST and (current) PCI DSS compliance? Blaming Microsoft for making it easy for sysadmins to centrally control a password policy through Active Directory seems, to me, just... very misguided.