I assume you are talking about customers of the bank not being required to change their password every 90 days.
Customers of the bank are not covered by PCI; PCI dictates what employees and others working on the infrastructure within PCI scope are required to do. To quote PCI DSS 3.2.1 Requirement 8 (emphasis mine):
Note: These requirements are applicable ...
As the linked article states, is appears the server farm was compromised rather than encryption being broken:
They eventually discovered that EncroChat was operating from servers
based in France and were eventually able "to put a technical device in
place" which allowed them to access the encrypted messages sent over
the company's network.