Well in this case they were explicitly allowed it just caused problems down the line when other system attempted to consume them.
String come up again and again as a hard issue to deal with especially once your start looking at Unicode. I think it would be very reasonable to assume only ASCII works and even then it doesn't always work!
Unicode really wasn't practical at all back then. Unless your entire system end-to-end was built internally, you'd have to interact with some non-unicode software. There was also no agreement on a common UTF-8 encoding, and other unicode encodings were all broken anyway.
Names have been spoken and hand-written since forever yet somehow computers aren't good at that so we all tolerate converting them to printed-looking text. Nobody cares, it doesn't matter.
ASCII only is not appropriate in some locales, as the keyboards don't have a-z. This is why in Thailand people tend to use their mobile phone number as their password, because it can be typed on all the common keyboard layouts they will encounter.
Also, with Windows 10 users will often not even choose their username. It gets generated from their given name + surname (which is a whole different issue for people without one or t'other).
Since identifiers like usernames are seen by people they are susceptible to homograph attack and _do_ deserve to be treated a bit more carefully. Also you probably dont want usernames like ń̸̡͍̲̲̫̰̦̔͛̋̉͊̔̈̈̈́̀͑͘i̶̜̔̐̅̔̑̈̕͝͝g̶̢̭̮̲͕͉͔͙̳̥͖̉̏̇̎̊̈́̊̆̃̎̑͆̿͠ͅh̶̡̛̪͔̯̯͈̼̿͊̂̍͐͒͐͐̆̽͛̄̽͝t̸̛͔̮̆͊̋́̑̓̅̀̆͋̕ͅf̸̤̗̺̣̤̝̟̱͎̦̀͒̽̓̋̏͌͋̇͛ͅḷ̶̭̓̿́y̵͍̦̫̫̠͆͛͋̓͑͑͋̔͑́̔̽̚̚
Unicode has been a thing since 1988. Names have included non a-z characters since forever.