That's the implementation here, with respect to the policies being global. 'Master' passcode length is stored in the global preferences, while 'master' lockout time is stored as an app-global value in the keychain, for security reasons.

Org-level passcode policies are still managed individually/separately, implicitly through the `SFUserAccount` object's identity data—i.e. at the user level instead of the org level.  I think the user-level demarcation is probably sufficient, and maybe even desired, if we ever get into a place where for example different user roles in the service have different passcode policies.