I discussed this with @ulferts and @apfelfabrik when I built the migration that moved user passwords to their own table. The result (I didn't fully like) was that immediately expiring all passwords was not a good idea, e.g. due to possibly a lot of support requests at one time. Also, an administrator might not expect the immediate expiry. We chose to use the last update on the user as an approximation for the date of the last password change when migrating from old data.