This is quite often false from my experience talking with people using bad passwords. The most frequent reason seems to be a basic misunderstanding of the problem, i.e. "But who would ever think of trying and manage guessing CowMilk76$ as my password."
So it mostly boils down to not being aware of computer assisted cracking, let alone modern cracking techniques with rules and statistics. They are imagining someone targeting them specifically, using their own hands and imagination. From that perspective, it is quite ludicrous to think someone would be able to crack CowMilk76$ as their password practically.
I'm not sure what the answer is, but longer and more complicated passwords aren't.
I think there'd be a veritable shitstorm if, say, AT&T suddenly decided to withhold iOS 13 for 6-12 months, while it's effectively SOP for Android devices (where you have manufacturers needing months to release a new version, then providers who delay it even further to test ... something).
In my experience, people don't want updates until they want some emoji, app, UI animation etc. that is highly desired but they cannot have it.
When they encounter such a situation, they hate it and feel bad for their poor choice of device. It is very off-putting when you cannot have that small thing that all your friends have without making a serious investment of time and money to upgrade to a new device.
iOS users very rarely have those bad experiences, when the new iOS is out even many non-technical users will get excited because they will be exploring the new shiny features and designs with their friends and nobody is left out. If some feature is missing, they will understand that their device is old but they will still get some shiny things and almost never missing stuff that is alienatingly bad.
That email comes in so many variants it's really entertaining. Someone is really trying hard to find the magic wording that gets through spam filters and makes people pay. It's not getting through my spam filter sadly, so when I want to read the latest episode I have to go look for it in the spam folder.
So I think what's far more important than choosing strong passwords is choosing different ones for each account.
If the manufacturer still imposes this level of control over the average user, it’s sort of just a worse version of a walled garden, isn’t it?
The real problem with updates is all the crapware that companies like Samsung foist on people. It's shitty software that never works right but still gets delivered and then its brokenness is in the way of an operating system update because of how shitty it is.
I'm not advocating for really any particular way of doing it, but rather just noting how Apple definitely has the opportunity for making OS updates a smoother experience than either Microsoft or Google because of their level of control at the hardware level. Apple doesn't always get it right (see Catalina), but they could do better than they do.
These days, most people I know, both on the iOS and Android side of things, approach updates with a resigned sigh of "what are they going to make me relearn for no reason this time?" with a healthy pinch of "man I hope this doesn't break anything." If Apple/Google owned up to this reality, maybe the updates would be smoother.
It's the same thing around passwords. People don't use weak passwords or reuse their passwords because they don't know any better, they do it because they do not care about whatever is protected by the password. I personally couldn't care less if someone stole my Facebook or that some bad actor may abuse something in my phone to send something to China. These digital things rank very low on the list of my priorities, and like me are a lot of not very technical interested people.
Some people buy cheap phones knowing they won't get updates, we know, we don't care. And we are happy to have the option not to care, we do not want more expensive phone with constant updates, just like we don't want the mandatory use of password managers. If we cared we'd buy/use them.