The article kinda misses the reason why mandatory password changes existed in the first place -- unknown breaches. The idea was that if there was an undetected breach, the attacker would have a maximum of the mandatory password change to use credentials. You would still have mandatory password changes upon discovering a breach, which would reset the counter. And the article wasn't very clear as to why this is no longer recommended, but when mandatory password changes are enforced, users tend to make new passwords which are trivial to crack if you have a known old password. So if there's an unknown (or even known) breach, users will tend to make a new password which an attacker can easily guess given the older known passwords, losing any benefit gained from mandatory password changes. And this is worse than not having mandatory password changes, because rare password changes (when a breach is discovered) don't put people into the habit of just iterating off of an old password.