It's a vestige from the implementation in 3.5.x. I can't defend its usefulness, but I acknowledge it's not being used. It would be used in DefaultAccountStateHandler as follows:

        if (configuration.isAlwaysDisplayPasswordExpirationWarning() ||
                ttl.getDays() < configuration.getPasswordWarningNumberOfDays()) {
            messages.add(new PasswordExpiringWarningMessage(
                    "Password expires in {0} days. Please change your password at <href=\"{1}\">{1}</a>",
                    ttl.getDays(),
                    configuration.getPasswordPolicyUrl()));
        }