Security folks decided five or ten years ago that forcing password changes is a bad idea. If you want to increase security, force everyone to use two factor.
If it were a good idea, it would be in core, or there would at least be a popular plugin that would do it.