Is it ever true that earlier indications that credentials should be rotated leads to worse outcomes, though, as just one example?

I'm sure I've received emails of the form: we suspect there may have been a breach, so we're forcing password resets, and have always taken that fine.