In some cases it's laziness, but in some cases it's because you're looking at the frontend to a legacy system. Especially if it's a bank or other finance site, there is a good chance it fronts a system from the 70s that can only take 8 character passwords and special characters blow it up.
Oracle allows (not sure if still true) alphanumerics and _, $, and #, and some websites just mirrored those rules. Oh and by alphanumerics I'm not even sure that includes anything outside of 7-bit ASCII.
