There's no good reason the max should be so low, but you should not hurt your users by silently truncating input or exceeding the entropy limit of a fixed-size scrambling mechanism.
It also appears that cut&paste is disabled for the change password fields which is REALLY annoying.
If you control the client side and it's a normal client/server-type application, absolutely, go for it. It poses much less risk to your users than any scrambling or key derivation protocol, no matter how strong. (Those do nothing to prevent getting your favorite password by snooping on ethernet traffic or memory, for example.) As you mentioned, SRP too has adjustable knobs.
It would be a little ironic if a company that's been strongly advocating the use of multi-factor authentication for many years now didn't enforce it for their own superusers. If that's not the case, then it's double ironic that those superusers are able to access the password digests in the database through that panel.
