form_alter and #element_validate inside .module file
As per @Clive comment, it's probably because password_confirm isn't a single element, it gets converted into two separate fields in a process callback, and doesn't apply the #element_validate to either of those because it can't reconcile which one you were referring to.