What does CompromisedPasswordChecker protect against that PasswordEncoder doesn't?

PasswordEncoder only handles safely STORING and VERIFYING a password; it says nothing about whether the chosen password is inherently weak or already known to attackers. CompromisedPasswordChecker checks a candidate password (at registration/change time) against known breached-password datasets (via k-anonymity so the raw password isn't transmitted), letting you reject passwords like 'password123' even though they'd hash and store 'successfully' otherwise.