> You might be able to justify non-compliance with a compensating control, but I've never heard of anyone who tried it.

I just did similarly within a SOC2 audit. I sent the auditors a list of 50+ articles and references i've been maintaining for years saying that password changing is a bad idea (this article is on the list) from many different sources. I never heard back and the item was marked approved by them.