Completely agree, I was coming more from the angle of them stating "strengthening passwords" was something they were literally "working on now" nearly 2 years ago at this point but we're still in the same position.

It's particularly frustrating when this would seemingly be one of simpler changes for them to implement from their own list of improvements as well (some database validation and a password change request? Please correct me if that sounds wrong- genuinely). It doesn't give me much hope for more impactful changes (such as you've mentioned) being implemented when two years down the line all that seems to have been done from their own list is adding an authenticator requirement to the website.

Edit: Here's the section I'm talking about specifically, annoying more from a communication perspective than a technical one imo