mayb bots trying to brute force? thats why they add captcha ?

from my what i understand.
CIMB put limit of 8 characters long password, but on their login page their password text box can input more than 8.
So when people key in their password + random characters, they still can login.
BUT technically correct cos the system only check the first 8 characters which is their password.
BUT logically is wrong cos anything you key in is not the same as your password EVEN with extra character is considered wrong.
eg,
apple123 is not the same as apple123456

imma rite????