I think generally people stick to ASCII printable characters because of the support cost, since the benefit of allowing non-ASCII passwords is not generally wor

I think generally people stick to ASCII printable characters because of the support cost, since the benefit of allowing non-ASCII passwords is not generally worth the headache of dealing with customers who find themselves trying to log in to their account a terminal that isn't configured for the character set their password is in. As for other special characters, a properly implemented password storage system would just dump these directly into a key-derivation function before it ever touches a database, but I think you get those rules from a mix of: 1. people who are storing their passwords in plaintext and are worried about SQL injection attacks and 2. people who know to pass them to a KDF before storing them in the database and either have inherited some old rule about "no special characters" or who are not convinced that someone in the future won't make changes to the system such that special characters would become a problem, and are trying to make it more robust to potential reversions. Not saying it's a good idea, but at least some people "doing things right" will still have somewhat reasonable concerns about special characters.