To clarify I never meant that the limit is a security issue, just that it's a valid technical limitation to limit the length of a password.