It doesn’t help that plenty of places still follow old IT guidelines that are bad, so they all get lumped together. E.g. change password every 45 days, can’t BT the last 10, must have 4 characters different, and we don’t have a password manager.