The admin user and role should not be forced to bypass the password policy

Just for clarity, by admin you mean user 1 right?

Removing the bypass permission is not an option as other sites need this feature. User 1 always is assigned all permissions by design of drupal.
Knowing that from a security point of view, it is preferred to disable user 1 and not use this account to do changes on your site but rather use a separate "admin" role where you can assign all (needed) permissions.

But we will check the code to see why the policy is not applied when you create a new user when you are logged in as user 1. The check should be applied against the new user object not the logged in user. We did a bug fix not long ago to check the policy when a new user is created/updated. Maybe something else surfaced.

"Just for clarity, by admin you mean user 1 right?" - Right!
"But we will check the code" - Great, thank you!

I just tested this with the latest version.

As an admin (user 1), which by passes the permission by default. If you create a new user, the policy is applied to the new account. So even as user 1 you can't create an account that does not full fill the policy.
Only setting the password on user 1 will by pass the policy, a solution for this, is as I explained before that you disable user 1.

I think the other "issue" is that when you assign a role to be an admin role in Drupal, it automatically gets all permissions. To prevent this you need to set the administrator role settings to none and manage all permissions manually. see https:///admin/people/role-settings

So unless I missed something in the initial request, I think the module works as it should.