Some password hashing algorithms have a hard limit, for instance bcrypt has a maximum of 72 bytes. Beyond that, not having a maximum opens you up to DoS attacks

Some password hashing algorithms have a hard limit, for instance bcrypt has a maximum of 72 bytes. Beyond that, not having a maximum opens you up to DoS attacks because attackers can tie up your servers by asking them to hash a few hundred 20MB passwords at a time.