FYI, maxlength is actually not enough to protect against people like me that are determined to break things for fun: Firefox 77 starts letting you exceed maxlength if pasting text in, to protect against accidental truncation. See https://www.fxsitecompat.dev/en-CA/docs/2020/text-exceeding-....

You may say it’s a fairly contrived failure, but it’s easily possible, and plausible if the user thinks they copied the password onto the clipboard, but actually those paragraphs of text they copied earlier are still on the clipboard. That sort of thing happens to people that use the clipboard (e.g. me) not uncommonly.