The person reusing a password is not the weakest link. The policy demanding 120 unique ones, rotated every 90 days, is.
https://blog.knowbe4.com/100-passwords-one-brain-stop-asking-humans-to-behave-like-machines
blog.knowbe4.com[Cybersecurity Awareness Month] 100 Passwords, One Brain: Stop Asking Humans to Behave Like MachinesPassword policies demanding 100 high-entropy secrets create cognitive overload. Discover why switching to passkeys and password managers boosts security.