Drupal module to block known bad passwords

One of the basic safety improvements

Best one probably: https://www.drupal.org/project/pwned_passwords

For avoiding bad (but novel!) passwords maybe consider https://www.drupal.org/project/better_passwords for implementing the NIST guidelines, or https://www.drupal.org/project/password_policy which can be configured the same way but allows more flexibility.