Changing credentials is helpful if you assume they're compromised every once in a while. These days if a unique and random password is used for each service and/or with 2fa enabled, that assumption is not that great anymore. Adding to that the fact that most people will just add "1" or the current year at the end, it makes updating the password much less useful - it will only stop completely trivial malware.
The recommendation has actually changed in high level policies relatively recently: https://nakedsecurity.sophos.com/2016/08/18/nists-new-passwo...
