You need to update both : core + Password requirement

        'passwordValidationRules' => array(
            'min' => 4,
            'max' => 0,
            'lower' => 0,
            'upper' => 0,
            'numeric' => 0,
            'symbol' => 0,
        ),

Password requirement didn't replace core here.

I suggest to consolidate the password requirement plugin into the core to have one single source of truth.
Password validation rules for administration & surveys should be shown directly in the security tab and editable there.

The plugin event itself can stay there.

The plugin event itself can stay there.

Here , both seem to do the same (if I don't make an error). But in my opinion, a plugin can replace core :)