It's a good habit to always create an upper bound on things (input max length, queue size, etc).

The person who wrote it just came up with 20 in the moment and forgot to go check, something everyone has done a hundred times.

I've probably never worked on a single system where the html validation, http server validation, and database constraint were synchronized on username max length. You choose a placeholder, an even number between 10 and 16, then forget to ever check.