Because it is something that is typically determined at the application
or OS level. Many/most of our users logon to the system with a single
logon at the D3 level .... everything else is then controlled by the
application - and I don't think we would be alone in this regard

If people are THAT concerned about security, biometric devices aren't
THAT expensive these days, and ypou are 100% right about the password
changes etc ... if still remember (and use) the password assigned to me
when contracting for a Government body 20 years ago, and so have used
it in MANY places where a secure password was required (which probably
explains WHY I have remembered it!)