Understand. Was reading http://tools.ietf.org/html/rfc2898, paragraph 5.1, step 1 ...

Personaly i would still prefere 128 as Default dkLen for RC2, for best security.
But your point is absolut valid.... for low-kdf it's too high. 

Because the other Crypt/*.php ciphers currently using its highest possible dkLen's [between 8 (DES) and 128 (RC4)] as Default for setPAssword()
i (still :-) ) suggest we are doing the same also for RC2... 128.

And if anytime phpseclib using a low-kdf like PBKDF1 or similar we have to search for a solution anyway.

ie a second default $password_key_size for this low-kdf or automaticaly cutting or something like this.

However... as a compromise...
What about, at least, $password_key_size = 16 ? (or 32? :-) )

Because RC2 with a 64bit key... even perfectly generated, isn't it, in todays day, easy to bruteforce such low-keys?