FWIW, I think the concern with "doesn't bother updating the passwords" was with respect to recovering from a hacked joomla install, not about an aging password management scheme.