“The site wanted at least two numbers.”
A random 16-character password from a password manager got rejected for having only one digit. Every site invents its own rules, so no generator can satisfy them all. The rules punish the users doing it right and do nothing about the ones reusing “Summer2021!” everywhere. Composition rules are security theater written by compliance checklists.