Calculating hashes is supposedly more expensive for longer strings. That could be used to simplify some kind of overload attack like DDOS.

since the plain text isnt stored

I'm not sure I'd accept a bet on that assumption.

Their backend is really, REALLY garbage. Maybe it is some of that Microsoft trash that they snake oil'd into a lot of public offices and dumbass corpo managers, but whatever is running that site, has me concerned. You don't do fucky things with passwords unless your backend is doing something really stupid.

A hash has a fixed length, including MD5. There's no reason to cap password (input) Iength. You can hash the whole bible and still get the same length hash. So either they don't even hash it, they're idiots, or they try to be unnecessarily cautious to avoid some other limit / overflow, like POST max size (which would still be counted in at least KB, not several characters). The limit on what special characters you can use is also highly suspicious - that's not how you deal with injections / escaping your inputs.

My default is to generate a 32 character password and store it in a password manager. Doesn't matter to me how many characters it has since I'm just going to copy and paste it anyway.

Pretty surprising how many places enforce shorter passwords though... I had a bank that had a maximum character limit of 12. I don't bank with them anymore. Short password limits is definitely is an indicator of bad underlying security practices.