10 years ago, that was believed to be best practice.

If they're still doing it in the last 2-3 years, they don't have anyone keeping up with modern security standards

At least it's not your data

My last employer did not, life was so much better after the policy change. Although my director lost track of how long he had worked there because he stopped incrementing his password every three months.