The password expiry feature has expired!

In general, changing a SHALL to a SHALL NOT directly is impractical. People will continue following the last version of the guidance that they've been audited to comply with until they can be audited to comply with a later version, and they can't comply with the later version if it's impossible to follow both at the same time, so you need to provide a migration path. (It doesn't apply to this case, but, in general, there may also be new requirements in the SHOULD NOT guidance that provide a replacement mechanism addressing the goals that the SHALL were for, where doing neither would be worse than continuing to follow the SHALL, and you want to say that people only stay in compliance if they implement the replacement first and get audited.)