Wait. Doesn't that imply your bank is storing your password in plaintext, or at best salted and hashed each individual character of your password? (Which is still horrible, because it now takes O(n) instead of O(n^8) to crack stolen hashes)
I believe they have some legitimate reasons for doing that (like the example quotes)
Another reason for specifying a length/limits is that you may need to type it using another device (like an ATM) and keeping it apart from other passwords (if you allow everything, you'll just use your gmail password or something)
Now, to be honest, if you break into a bank db, why are you going to bother with passwords?
Yes, if the machine is compromised the attacker could do it as well but the point was to prevent keyloggers specifically.
You are presented with
* * [ ] * [ ] * * [ ]
and you are supposed to submit
* * [3] * [5] * * [8]
so neither side would have enough information to reconstruct the full password based on the user's input alone.