The regexp based validator:
info.magnolia.module.form.validators.ValidateExpression
extends the class:
info.magnolia.module.form.validators.NoHTMLValidator

Using the NoHTMLValidator as a base class for all other fields makes sense, as it prohibits html characters in form fields. But the NoHTMLValidator prohibits characters which are perfectly fine as password characters.

So the ValidateExpression should directly extends the base class Validator, and if by default it still should constrain by the html characters, it should directly be added to the used expression itself. So its obvious and easy changeable.