I would assume the harder looking passwords actually came from a "known backdoor" incident. Like where a manufacturer of IOT or router puts in backdoors for development then forgets to remove before production