SQL Server 2017 password complexity rule
Is this expected behaviour of SQL 2017 for SQL login password?


Yes, it is expected. You might have overlooked the three of the following four categories part of the Password Complexity doc:


  
  The password contains characters from three of the following four    categories:
  
  
  Latin uppercase letters (A through Z)
  Latin lowercase letters (a through z)
  Base 10 digits (0 through 9)
  Non-alphanumeric characters such as: exclamation point (!), dollar    sign ($), number sign (#), or percent (%).
  
  


Therefore the password TestingDB@001 has characters from the four categories while testingdb@001 has characters from three (which is the minimum acceptable to pass), so both passwords are in accordance with the policy.

As for the Windows login it has a policy Reference that is quite like the one from SQL Server and also says The password contains characters from three of the following categories.