One common criterion for a 'bad password' is a password that is already contained in a rainbow table or is easily generated upon creation of a new rainbow table.
If the current password is in the table, how long it has been in use doesn't matter.
Rotating passwords mostly addresses an internal workplace issue of sharing passwords between coworkers. That's a symptom of security culture problems and probably more deeply operational organization problems => why don't people have access to the tools they need when they need them?
