[cabirum]

From the employer POV, employees cannot be trusted to discover their passwords are compromised, so updating them limits the duration the leaked password works.

[cheriot]

Did NIST not take this into account?

Frequent changes mean more people write them down.

[afiori]

Frequent changes are a good way to move the blame on employees