They've very slowly been getting better at various ridiculous UI issues. For example, they finally have a proper TOTP system (rather than their old security key that nobody used).

But yes 20 character password is infuriating. My guess is that, at some point, it's extremely hard to change the password character limit and make sure it's correctly updated everywhere at once. Passwords are used in several places and they're afraid of missing a few.

That's my most generous reading of the situation. I still think Paypal is pathetic. Their country locking is the most awful shit: you can't use a foreign phone number, it has to be one of the country you registered with Paypal. If you move country, tough fucking luck, you have to close your account and open a new one and that's "standard procedure".