Oh hun, that ship sailed a long, long time ago… in particular, we allow reducing the minimum password length, and that’s arguably more “no, seriously, you don’t want to do that” than increasing the max password length.
I suppose we could benchmark where the CPU time required goes from “that takes a while” to “OMFG no wai!” (if that wasn’t how 200 was determined initially), but someone’s going to have a password that’s a bit longer than that, and a really fast CPU, and wonder why they can’t login…