If you store all the password history of a user, by mitigating one weakness you end up introducing another.
Weakness 1: users might reuse old passwords, possibly invalidating a security control (the security control that was meant to stop attackers from getting persistent access once they have stolen a password).
Weakness 2: all the history of passwords is stored in the database, so in case of a leak the attacker will gain a lot more information, possibly even stealing old passwords that a user might still use somewhere else. Imagine this password history: ['stackEx178', 'stackEx179', 'reedStackEx!', 'f8o17dh4m834H', 'r837cbKeTW7p9']. It looks like the user at some point started to use better passwords, maybe they even learned (or they were forced to learn) to use different passwords on different websites... but the old passwords (or similar passwords based on the old bad habits) might still be in use on some other websites.
By trying to mitigate weakness #1 (deciding to store all the passwords) you end up introducing weakness #2. However, I'm not sure which weakness would be the worst. Is it better to let users reuse the passwords? Or is it better to risk leaking the full history of passwords in case of an attack? I don't know.
All I can say is that by using very strong hash functions (with salt and pepper), you might be able to contain the damage in case of a leak. And by implementing some kind of access monitoring you might be able to mitigate the risk of stolen credentials without relying on regular password changes. I personally wouldn't like to store old passwords in the database forever, and would prefer investing more resources on some kind of access monitoring, suspicious behavior detection, and user training if possible.