The rules, if used properly, work perfectly. But using them properly is burdensome, which means most people get lazy and the result is insecure passwords.

There are about 95 letters, numbers, and punctuation marks and symbols. If you choose a 12 character random password, it's uncrackable by brute force. The problem is, few people want to choose and remember a 12 character random password, and fewer will do that for each of the dozens of passwords they must use, so they choose insecure, non-random passwords.

In general, every two random characters is worth as much as one random word. I personally find it as easy to remember three random characters as a word, so I get better mileage out of random characters.

Rotation is great if it's implemented correctly. The problem is that it's too much of a burden on users, therefore they implement it poorly, and then it's less useful or a weakness.