That observation matches my experience, at least for cheap offers. I bought a one-year subscription to ivacy.com (a Hong Kong based provider ~ Chinese government controlled) at a ridiculously low sales price and it turned out that they impose a maximum password length of 8 characters limited to a small ASCII set. It's like buying a cheap Casio watch imitation with a "waterproof" sticker on it - not really waterproof...