But is there any good reason to forbid users from choosing longer, more secure passwords while still limiting the number of attempts and doing heuristic fraud detection? You know, other than that sixty year old legacy system that stores your passwords in clear text and doesn't support any other format than six digits?

Card terminals only have numbers. Not planning to ship them with a full keyboard. That's a good reason to only take numbers.

Not to mention that Indo-Arabic digits are almost universal, other characters are not. Picture a chinese or armenian with a password that uses characters from their respective alphabets trying to type it on each other's ATMs.

That seems like a pretty good reason already.