The length checking wasn't accounting for null bytes within multi-byte sequences and could step over the null bytes. For BLI_strlen_utf8 this could result in an out of bounds read. In practice most UTF8 data is validated so the extra checks are mainly to prevent errors on invalid or corrupt UTF8 text.