The longer a user uses the same password, the greater the chance that an attacker can determine the password through brute force attacks. In addition, any accounts that may have been compromised remain exploitable for as long as the password is left unchanged. If password changes are required but password reuse is not prevented - or if users continually reuse a small number of passwords - the effectiveness of a good password policy is greatly reduced.

https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/enforce-password-history