The reason is most likely to prevent buffer overflow attacks. Consider this: nearly every virus ever written has used a buffer overflow exploit to gain access to a system or server. To prevent these attacks, programmers enforce maximum lengths on buffers (in this case, your password field).
A buffer overflow exploit works like this:
1) Program is written expecting, but not enforcing, a maximum length for a string.
2) Malicious user inputs a string longer than that expected, so his string copies OVER ("clobbers") legitimate data. In stack-based languages (most languages like C/C++/Java that use function calls), the object is to write a string long enough to over-write the return address, sending the program to begin executing in the middle of his string instead of where the previous function left off. The trick is that the user did not just type ANY string--oh no... he typed a very carefully formulated string that would be interpreted by the language as executable code.
3) User's "code" string is executed, giving him control of the system.
That is why text fields and buffers have length restrictions. Normally, buffers will just be truncated, chopping off all the excess characters, but you can understand that that would be unacceptable for passwords, for they are memorized and must be stored exactly as each user expects.
Why such a short maximum length? Who knows. 8 is as good a number as any, and it is VERY certain that there must be a size limit somewhere.