Id like to understand the risks more in depth to explain it to someone who has a password policy that is not configured at all.
I take it from your question you have a brand new Active Directory domain that has been set up with default password policy. Presumably you also have default account lockout policy as well.
By default, passwords have an expiration of 42 days, a minimum length of 7, and must meet password complexity rules (e.g. cannot contain the user name, must contain any 3 of uppercase, lowercase, digit, special character, or symbol). These rules don't seem terrible, so leaving them at their defaults doesn't present an intolerable risk.
However, account lockout policy by default is disabled. This opens up your domain to brute force attacks, since a user can try as many passwords as they want for as long as they want. At a minimum you should turn this on, even to a somewhat high number (e.g. 20).