[_wldu]

Yes, and I believe they initially made this change in June 2017 (almost 5 years ago now). IT audit/compliance is typically 5 to 10 years behind best security practices and some standards are even slower to catch up.

[ryangittins]

Welp, I guess I am now old enough that 5 years ago "relatively recently." :/