As far as I can tell from some quick searching around, that limit only applies to cookies set through JavaScript code, as opposed to through server headers.

I assume it's because of situations where websites include JavaScript from a third party, and then that JS uses first party cookies as a state-keeping workaround while synchronizing tracking information in some other way.