Hasn't been changed in years in my company. Just how seriously do you suppose this is taken? (Whereas personal passwords to access our own rosters, e-mail & flight planning are religiously changed every 3 mths...)
Everyone knows the bulletproof door is merely a sop for politicians to pretend they've done something. It has no bearing on safety, security or anything else that is practical, except to make CRM far harder, and just be a bloody nuisance to everyone except terrorists.
Pure pointless political pretence.