It's often due to the security department following outdated standards. Nowadays NIST recommends the following:
Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.
Source: https://pages.nist.gov/800-63-3/sp800-63b.html
That said, the company I work for violates all of the above rules ...
That one is the most stupid one too, because master in git doesn't even refer to a master/slave relationship. It refers to a different meaning of the word master, namely "an original from which copies can be made", as in master recording or master key. See 5b in the Merriam-Webster dictionary. And that's how it's used in git: any new branches are derived from master. Main just does not have the same nuance, because it does not imply a relationship between the branches, just that it's somehow more important than the others.
But of course, the real reason it was changed is because for companies like github it's easier to give in to the crazies who demand this than to fight them.