Aside from the "variety of each char doesn't matter when you allow 8-char passwords," there's also the bullshit of "and one of the chars has to be from this set: {!, @, #, $, %}" which (a) if one-upper-one-lower-one-nonletter actually mattered this would cripple the password, and (b) the one-upper-... thing doesn't fucking matter, brute-force will attempt all 93 printable ASCII chars anyways.
When in heaven's name will password fields use all 254 non-null values for each char? Let me have Malaysian, Hiragana, Georgian or Elder Futhark passwords, damn your security theatre.