[jacobr1]

Often that is the size of the DB column and the password is stored in plaintext (or was and the size restriction remained).

[jsingleton]

This is usually the case but there are frequently short length restrictions even when it's hashed. Sometimes only on the client side too, so you can just remove the attribute from the input.

[pavel_lishin]

As I understand it, those restrictions are typically due to having an interface with some legacy system where those restrictions can't be removed.