Does VTTablet credential caching delay password expiration enforcement?

Vitess delegates authentication to the underlying MySQL server, where least-privilege access is managed via standard MySQL user privileges. When a user's password expires on the MySQL server, VTGate typically forwards the authentication request, and the connection fails with MySQL error 1820.

However, VTTablet maintains a cache of connections to the underlying MySQL instance. There is uncertainty regarding the behavior of these cached connections when a password is changed or expires while the connection is still active in the pool.

If the underlying MySQL account is modified or expires, does VTTablet continue to reuse existing cached connections until they are naturally closed or the tablet is restarted? What is the expected propagation delay for credential updates across a cluster in Vitess 2.x?