I would also argue that the security implications of this are largely positive. It removes less than two bits of entropy even from a randomly generated password

I would also argue that the security implications of this are largely positive. It removes less than two bits of entropy even from a randomly generated password, but it means that users reset their passwords less often, and I would guess that when users reset a "forgotten" password, they usually choose something weaker (and thus more memorable).