That begs the question: are they truncating the password string before hashing it ... or truncating it and saving it plaintext?

I don't understand enforcing a max password length when the password should be stored as a hash.