A 250MB requests should get blocked by your web server way before it touches your code or your database.

But yes, you're right, limiting passwords can help avoiding edge cases where a long password is not handled correctly ecc... Just pick a sane length that no-one will hit, like 1000 chars or more.