And yet, there are Fortune 100 financial institutions that require their vendors to have a policy of mandatory 30 day rotation for sysadmins and 90 days for non-privileged persons. Companies that don't have and enforce said policy are unqualified for the privilege of vendorhood. Pointing out this Microsoft paper, the NIST guidelines, or the NCSC guidelines will just get the subcontracted droids giving you a negative mark on your annual vendor security assessment.
No, I am not jaded or bitter on this topic. Why do you ask?