For one thing, the fact something's supposed to fail on unexpected input doesn't always mean it will fail.

For another, some implementations thought they understood name constraints, but had bugs in their implementations. For example, applying name constraints correctly to the certificate's Subject Alternate Name but not applying them to the Common Name.