I loathe policies about expiring passwords because it breeds insecurity in the manner you mention. However, my company has this same policy, not because its been evaluated as being a good policy, but because our SOX audits require it.

Another reason to grumble over SOX.