You don't want someone to use password that is millions or billions code-points in length. Technically in spec, but utterly stupid and useless. Just don't go too low.

DOS/resource exhaustion. It doesn't need to be something dumb like 24 characters.