I believe the new 'password rules' should include a trick that we've used long ago: adding a 2-4 character 'salt' before the easy-to-remember phrase-based passcodes; where this salt to be updated every 1-2 years by generating it randomly; maybe even from a dictionary for easier memorizing as well.
Let's admit it, the 'randomness' can be only generated. Relying on human users to come up with a good random password is not a truly secured approach.