Or they just have length bounds on every string input that they have (as they should) but the person in charge of deciding the bound for the passwords did a bad

Or they just have length bounds on every string input that they have (as they should) but the person in charge of deciding the bound for the passwords did a bad job and picked too low of a limit.