> Your assumption is that there's zero time between a leak and the abuse. If my password reaches the abuser after it expires, then I have been saved by the rotation.

Nope, that wasn't my assumption. What I said above applies there equally.

> Also rotation + "no reuse" policy essentially guarantees that eventually the password will be unique and not reused across services.

No it doesn't, in fact it increases password reuse and results in pattern-style passwords.