Unless you can only change on a pre-defined interval, the attacker can always change your password for you to avoid being locked out. I don't know many users who would complain their their password seemingly never expired.
These are often combined with a requirement to not reuse some number of recent passwords, so the attacker can't change the password right back again. When you can't log in then your password will be reset and they've lost access.
