TD Canada Trust didn't let me use more than 8 alphanumeric characters in my password until about 2015. The only let you use call or SMS for 2FA to this day.
They are charging $16.95/mo for a chequing account right now.
This is pretty standard across the big banks.
The situation is quite rough indeed.
I'm not arguing it's necessarily more secure. I haven't audited it or looked into how it works.
Hard 8 character limits are often a side-effect of old COBOL "databases" in the backend somewhere.
Hard 16 character limits are sometimes a side-effect of old versions of Active Directory in the backend somewhere or new versions of Active Directory in certain backward compatibility operation modes/certain group policies.
Hard character limits in general are often a sign that someone is storing the plaintext somewhere they shouldn't be.
(Soft character limits today are mostly to avoid possible hash function DDoS.)
Nobody should be using LM or NTLM hashes anymore today, for all that that means... >sigh<