This is an old entry and it should be updated. Password complexity is a concern when changing the SYS/SYSTEM passwords on 19C and above. Oracle 19C has a more complex password complexity requirement and when changing the SYS/SYSTEM password on an upgraded database, you should follow the 19C complexity requirements. This is especially important for AWS RDS, Oracle on-prem cloud and Oracle public cloud (OCI) implementations where the database service is used. You could conceivable continue to use password complexity that is less than what 19C and above call for, however there are numerous consequences. The most obvious consequence is that doing things like setting up a DataGuard instance will fail, since some of the cloud SDKs test for 19C complexity requirements prior to passing the PUT call to the REST API service (aka you get a beautiful python error - or something to that effect).
I make this post since I ran into this issue last week when attempting to provision a DataGuard instance from a 126.96.36.199 database that had been upgraded from 12.x. Long story short, the provisioning failed, and after a long chase it was determined when working with Oracle Support that I had to address the client's not having touched the SYS/SYSTEM password after upgrading from 12.x.