The "change your password every 6 months" guidance?
That was revoked some years ago.
Specifically the revocation of such guidance. If the field gave even the slightest deference to empiricism we wouldn't be changing our password every 180 days, but here we are.
That was revoked some years ago.