I’d say it does apply transitively, but only if the weakest link itself is also strong enough, and passwords are not.