From the employer POV, employees cannot be trusted to discover their passwords are compromised, so updating them limits the duration the leaked password works.