This is what most corporations want, esp for remote employees. I had a work supplied laptop and I couldn’t access via my machine account password. I could login via MFA but I couldn’t reset my local password. They made me initiate the account recovery, wait 8 days, and then I could change the password. I suspect my employer’s account synchronization tools mangled my password or changed it to a password in flux.

In that light, they are fulfilling a use case with greater market value than your conundrum. Is it annoying? Sure. Is it a problem? Debatable. You didn’t recover the passwords on the machine when your employee left. Maybe it’s your problem? Will you get in? Likely and eventually.