While that is what many password policies attempt to do, moving the user passwords from dictionaries and into a form that can only be brute forced, they're forgetting the most insecure part of the password: The human mind.
Human minds are terrible at generating true randomness. They're even worse at memorizing random values. If there's a pattern that they can follow to help them remember it, they'll use it.
And, most damning of all, humans will reuse passwords.
Attackers have caught on and, rather than making their dictionaries based on words found in various languages, they make their dictionaries based on previously leaked passwords.
The current advice to users is to remember two passwords: The one to log into your computer, and the one to log into your password manager. Never try to memorize any other passwords, and never try to generate a password on your own. Let your password manager make truly random passwords, as these are the only ones that are guaranteed to not have shortcuts like dictionary attacks, keyboard pattern attacks, and the like.
The current advice to people setting up authentication systems is to follow the NIST standards. Specifically,
- Do not force users to use different character classes like at least one of each upper, lower, number, and symbol characters.
- Check that the password hasn't been leaked before when the user sets or changes their password (i.e., use the Pwnd Passwords API).
- Do not force users to change their passwords for arbitrary reasons, such as periodically.
- DO force users to change their password for specific reasons, such as a suspected leak of your database (and be honest when such a leak happens).