Suspect "Admin (UID=1) password expires" setting does not fully work

This code does not look right:

function _password_policy_block_account($account) {
  if ($account->uid > 1) {
    // We never block the superuser account.

It seems like it should be dependent on the password_policy_admin variable.