IMHO accepting password length< 8 and >0, and ignoring it. is not right, should be failed.

if(!passphrase || strlen(passphrase) < 8) {
        conf.ap.authmode = WIFI_AUTH_OPEN;
        *conf.ap.password = 0;
    }

people think they secure their AP and actually it become open

ESP8266 use code that seems correct to me :

if(passphrase && strlen(passphrase) > 0 && (strlen(passphrase) > 63 || strlen(passphrase) < 8)) {
        // fail passphrase to long or short!
        DEBUG_WIFI("[AP] fail passphrase to long or short!\n");
        return false;
    }

The issue with how it was originally written is it fails silently and only returns a bool with no way of knowing why. Also, it should've been checking for strlen(passphrase) > 0 in the test for too long or short, allowing 0 length passphrases to fall through to WIFI_AUTH_OPEN. Added a couple log_e() statements and kept the truncating of long ssid/pass.