Exactly, such anti-abuse limits would start at, say, 256 characters. The amount of banks and services that limit their passwords to 20 characters or fewer is startling.
I've seen even worse than that - for low-importance passwords I normally record them in a mail-to-self memo then paste them into the signup form. I recently encountered one site that silently truncated the pasted password.
While silent truncation is of course bad because it limits the potential entropy of a password, if implemented consistently it's technically not any worse than a limit that's presented to the user. But just wait until the new hire doesn't know about it and implements a form without it, and then all of the sudden users are entering the same "long" passwords they always have and scratching their heads when it fails.