I have often seen password fields that are only limited by their attribute. Eg

  <input type="password" maxlength=20>

You're right, if they actively limit the character set and the length, it must have been a conscious decision.