Change travels very slowly - some years ago NIST and everybody else's recommendations used to require password rotation, so lots of policies and habits of policy writers/enforcers and educational materials still echo the old recommendations.