Must members of an ArcGIS Online organization change passwords immediately after a password policy change?

No. While changes to the password policy of an ArcGIS Online organization applies to new members added after the change, it does not affect existing members until they update their passwords.

Members of an ArcGIS Online organization are not required to update their passwords upon logging in after an organization's password policy change. They may continue using their current passwords, even if they do not meet the requirements of the new password policy, until their passwords are updated in the future (in the event the passwords for their ArcGIS Online accounts expire or they reset their passwords).

When the password policy changes, existing members are notified of the new requirements via email.