We have this issue in an internal tool at my workplace. My coworker is the only one who has long enough password and is too stubborn to change it, so they change the (client side) limit every time they log-in.