If the threat is that someone might steal or guess your password, and then access your data, then it can be mitigated in various ways. I think Google for example checks the location and device that tries to log it, and if they notice something unusual (like signing up from a different region), they block the access and ask a security question or force you to use 2FA. I also just tried to create an account on Google, and they won't let me use a simple password like "123" (8 characters are required, etc.). I'm also pretty sure it limits the attempts in case someone wanted to guess you password, although I haven't tried this. As you can see, Google does try to mitigate this threat. Forcing a user to change passwords regularly might not be useful at all, if you consider that other mitigations are already implemented and that being forced to change passwords is often considered a pain by the user.
However, if a service (Google, Facebook, whatever) allowed users to sign in using very weak passwords like "123", I believe it would be such a bad practice that it would really put users at risk, even if other ways of mitigating the threat were implemented. It would not be acceptable. I haven't checked if any major services allow this, I hope not. I don't know if any of this can be considered "illegal" or not, anyway. All I can tell you is that in the European Union, the GDPR (General Data Protection Regulation) says that you must take data protection seriously when you process personal data.