Your average developer considering allowing UTF-8 is going to weigh the cost benefits of unicode normalization vs. just forcing the user to use the lower ASCII

Your average developer considering allowing UTF-8 is going to weigh the cost benefits of unicode normalization vs. just forcing the user to use the lower ASCII code page and is going to opt for the lower ASCII code page. If you are randomly generating the password anyways, I'm pretty sure allowing full UTF-8 will decrease the entropy since there are more wasted bits. I could be wrong, and I am too lazy to run the computation at the moment. Moreover, a randomly generated UTF-8 password will almost certainly contain characters that are difficult for the user to type.