Even simpler, I believe you can simply provide a site_settings.yml in your plugin that replaces the setting definition.
(I do worry about the fact that you’re changing min password length, though - the common passwords protection doesn’t take into account lengths under 10.)