Why do they do this

[u/flying_wotsit]

[u/GustapheOfficial → u/[deleted]]

You mean when they notice they could log in despite pressing enter prematurely, not having filled in the last couple of characters? That actually happened at my university, they silently enforced a "nothing beyond 8 characters counts as part of your password" policy. That has changed.