This actually makes sense. QUOTENAME is really for quoting an object's name. Object names use the datatype sysname (which is a synonym for nvarchar(128)), and that is actually the expected input type for QUOTENAME too. 258 is 128 x 2 + 2, which means that it can handle every possible object name. The +2 handles the brackets () at either end, and the x2 handles the escape characters. Thus, if someone was (foolish) enough to create an object with 128 ]'s, QUOTENAME would be able to return the correct value:
Which returns a 256 ]'s enclosed by brackets ().
Excuse my typos and sometimes awful grammar. My fingers work faster than my brain does.