This is very good advice that I find almost nobody I know follows. It is such a simple step that covers such a large attack surface that I am surprised this isn't more common practice since it gives you a nice peace of mind on the input.
Every other time I suggest it in code review, I get a `but it works without it` and then I have to re-explain a bunch of stuff.
> it works without it
All security "works" until it doesn't.
All of the hand-wringing about FB and Equifax drives me nuts because all of it was completely predictable. But no one wants to hear it until the horses are out of the barn and galloping over the horizon in a cloud of dust.
Case in point: you should never use plain-text ascii as a key directly. You should always run your source key through a KDF, which will produce an actual key of the proper length. Also, what matters is not the length of the key, but how much entropy it has. Anything more than 128 bits is serious overkill.