The advice on passwords very much depends on the level of control that a system operator has on its userbase, and the threat model of the site. In an end-user

The advice on passwords very much depends on the level of control that a system operator has on its userbase, and the threat model of the site. In an end-user B2C style website, whilst passwords (and MFA) etc are needed for Authentication, the operator has limited control over users and if you annoy your users too much, with things like mandatory system generated "high entropy" passwords, they'll stop using your site (assuming there are other options available). In a corporate style service it's different as the operator can mandate things like the use of MFA and the use of password managers. I've seen systems that did the "system controlled password" thing in the past and, if done incorrectly, it just leads to users writing their passwords down somewhere (e.g. sticking them to a post-it note under their keyboards).