The worrying thing about that limit isn't the limit itself, but whatever process they are using to process passwords that imposes that limit.

I mean, if they're hashing the password as they should, why the limit? It's stored as fixed length string anyway...