It would be interesting (and helpful) to see some real-life examples of which Websites disallow what characters. Then maybe we could hazard an explanation.

Possibly they're preparing for password entry on more ubiquitous devices with limited keyboards? (ATMs, credit card keypads).