In my experience you are not wrong.

The auditor will require evidence of password rotation and take that evidence into their report. I don't see any way an audit could pass lacking this evidence, on either end here.