Recommending not expiring based on time is probably my favourite. I've worked at two places where that's been a requirement and my password has always been a passphrase combined with a sequencial number.
It was frustrating.
My password wound up being "<main-password>4444444". Was always a little mystified that I could hammer out seven 4's without counting them faster than I could remember that I was at a suffix increment of "10" or "11".
I mean, I guess they could login to your bank every week and transfer out $50 instead of just transferring out all your money on day 1, but... ?
However, in most cases people are dumb, greedy or the combination of both - e.g. in February 2014, a concerted mass hack occurred across Germany and over 10M € were reported as losses (http://www.spiegel.de/spiegel/print/d-126511954.html), and most other bugs surface fairly quickly because people exploit them until the machines run dry and the owner/manufacturer inspects them.
So, in the case of gambling machines/casinos, a small-scale hidden compromise is far worse than a "big blow" - thankfully for the industry, greed usually prevails over common sense.
The first to come to mind is a corporate espionage scenario. Do you want to know what your competitor is up to today, or do you want access to their briefings/CAD/code for the next 12 months? Long duration compromises also allow you to slip data out slowly, so a NAS doesn't show 200GB being transferred off in a matter of hours, but a slow drip of 100MB a day.
At a personal/home use level, long term access to a bank account allows an attacker to build up a spending profile, which depending on your habits, could be used for blackmail.
We've been working under this fantasy that it's acceptable to make a "strong" password and have a meaningful expectation that you can maintain the security and integrity of access. Multi factor authentication is the best solution to this problem -- a moderately complex password with MFA is stinger than a password.
If you want to compromise somebody long-term, you move laterally within the targets network and infect multiple devices.
Forcing password rotation guarantees that most people will just use the shortest possible password and stick some rotating suffix on it because your policy is pointless and annoying. You make yourself the adversary when you enforce policies like this and people stop trying to be secure and just try to get on with life.
Presumably the attackers were worried that after several transfers the bank would notice and block further access, so they kept a roster of compromised accounts to attack all at once. I suppose that a password rotation policy would have helped mitigate damage in this case, though something like fail2ban or automated IDS would have been better.
Also it's not just for the account of the terminated person, but for any passwords the terminated person has 'learned' whilst employed.
The point being that what you are seeing as benefits of password expiration are better achieved with proper polices that management and HR operate under... while password expiration may in some ways help you achieve your goal in a lazy manner it also opens you to ALL your employee's using weaker passwords and giving you way more attack points than the off chance that someone decides to not follow the policies you established above.
Also none of those policies require an "IT pro" ... implementing them might, but understanding the goal of the policy and putting them into place is something any good management team should be able to accomplish.
Also remember passwords are only ONE part of your security armour, they aren't the entire suit.
PCI is nothing more than Security Theater so Mastercard and visa can claim it is all the merchants fault for data breaches and shield them from any liability
However, I've heard that the process varies widely depending on who your auditors are. Some are apparently very permissive, but we got the other end of the spectrum.
/^(.*?)(\d+)(.*?)$/ $ echo abc9def | perl -pe 's/(\d+)/$1+1/e'
abc10defI started the first week of December, 2010.