People should remember that the recommendations are part of a large security program and assume the implementation of others that are not so straightforward. Multi-factor auth and resistance to offline attacks on a stolen database or MITM'd creds in an outdated Windows environment tend to be big technical pain points. Most companies, especially outside of tech, aren't in a position to remove password expiration yet.