Where this came from is stuff like the DES crypt implementation where passwords were truncated at 8 characters and then 7 bits were extracted to form a 56 bit D

Where this came from is stuff like the DES crypt implementation where passwords were truncated at 8 characters and then 7 bits were extracted to form a 56 bit DES key. You simply couldn't have long passwords back then. The first widespread crypt implementation that could handle long passwords was probably PHKs MD5 based scheme in 1995 -- contemporaneously around the release of Netscape Navigator. If you only had 8 characters then you needed to include multiple different character types and needed to not use dictionary words. So for the early internet those became the standard recommendation until long-password-supporting crypt()s became standard in operating systems. Having gone through a decade-ish of those password standards in the 90s by the time all the operating systems had updated their crypt() standards a lot of people didn't really notice until the xkcd comic in 2010. And now you've just got to fight 30-ish years of inertia of those being considered the standard.