Oh, but most companies do enforce such a policy. Often, however, these policies do more harm than good such when they require passwords of a specific length and composition or demand you change those every 30 days.

Rules like that lead precisely to passwords that are easy to guess but hard to remember. I suppose nobody can even tell anymore who originally came up with these rules but they're widespread and ingrained in many companies' cultures.

Getting rid of this security cargo cult and replacing it with better practices (such as using password managers and allowing for easily pronounceable, diceware-like passwords) is surprisingly hard.

Companies do enforce security policies. Most often, there’s a bit of cargo culting / going through the motions to prove to compliance or the SEC or whoever that you’re doing something. It’s also complicated, on (large) companies’ timescales, to adapt to the changing threat models. Which is why we still have “8 characters including a number and an upper-case letter, to be changed every 3 months” nonsense instead of generalized password managers and MFA devices. (Try installing a password manager on your average locked-down corporate PC).

And even then, you’re still back to the fact that companies are large groups of people who range from Franck the IT guy who knows about security to Dennis from accounting who has all his passwords on a post-it and will gladly give them over the phone if “Gladys, the VP of marketing who needs access to the finance tool to update the budget forecast right away, before the big meeting with the CEO, you don’t want to upset the CEO do you Dennis” sounds persuasive enough.

However, I agree that companies are better at security than individuals, and will (hopefully) slowly drag the average security level up through employee education. It will take a while for the Dennises of the world to get the message, though.