Password complexity is not a critical validation. The client-side code could easily perform the same validation before hashing. If someone hacked the client-sid

Password complexity is not a critical validation. The client-side code could easily perform the same validation before hashing. If someone hacked the client-side code and intentionally disabled the validation, then they could submit a weaker password, and that's not a big deal. It's a huge win if the plaintext password doesn't leave the browser.