That, basically, is the case.   The number-one most often used password is:   password.   Close behind them are:   enter, secret.

Nevertheless, it doesn’t work.   Enforcing complex password-rules simply causes more passwords to be written down.   When a system is broken into, it usually is not from “forcing” a password.   There are too many “other” ways into a complex system.