It's reasonable to put measures in place so users can't transmit excessively large amounts of data where they are not expected, login forms being one example.

It's reasonable to put measures in place so users can't transmit excessively large amounts of data where they are not expected, login forms being one example. But there is a lot of wiggle room between maxlength=8 and allowing people to upload the source code of DOOM as their password.