Weak passwords are being allowed when creating account on checkout

I have recently noticed on multiple sites that people creating accounts on the checkout page are able to use weak passwords. The meter says weak but if you submit the order the account is created anyway. I have checked and it seems that weak passwords are stopped for other types of registration so it seems to be a WooCommerce issue?

The first site was heavily customized by someone else years ago so I thought he had unhooked something. But I have since found it on a couple of other sites. Is there a bug allowing these?