When setting a password during front end registration using the core users/save-user action, Craft actually sets the newPassword attribute on the user model, not the password attribute.

This means that you should test the length for the newPassword attribute, not the password attribute, i.e.:

if (mb_strlen($user->newPassword) < 8) {
    $user->addError('password', Craft::t('yii', 'Password must be more than 8 characters.'));
    $event->isValid = false;
  }

Another issue with your code is the if ($user->password != $user->confirmPassword) { conditional.

The user model doesn't actually have a confirmPassword attribute. It's odd that you're not seeing an exception thrown here (are you using devMode during development?), but regardless, the code is not going to work as intended.

Note that you also can't do $user->addError('confirmPassword', ...), again since the user model doesn't actually have that attribute.

Assuming confirmPassword is an input in your registration form, you'll need to change your code to something like this:

if (mb_strlen($user->newPassword) < 8) {
    $user->addError('password', Craft::t('yii', 'Password must be more than 8 characters.'));
    $event->isValid = false;
  } else if ($user->newPassword !== Craft::$app->getRequest()->getBodyParam('confirmPassword')) {
    $user->addError('password', Craft::t('yii', 'Passwords do not match'));
}

(The reason I'd recommend the above as an if-else conditional is the fact that you can't set a separate error on the user model for confirmPassword, again since it's not an actual attribute for that class.)

Beyond this, while doing custom validation in an EVENT_BEFORE_VALIDATE event handler should work, the recommended way to do custom validation in Craft is to add Yii validation rules via the Element::EVENT_DEFINE_RULES event. Check out this page in the official docs.

When setting a password during front end registration using the core users/save-user action, Craft actually sets the newPassword attribute on the user model under the hood, not the password attribute.

This means that you need to test the length for the newPassword attribute, not the password attribute, i.e.:

if (mb_strlen($user->newPassword) < 8) {
    $user->addError('password', Craft::t('yii', 'Password must be more than 8 characters.'));
    $event->isValid = false;
  }

Another issue with your code is the if ($user->password != $user->confirmPassword) { conditional.

The user model doesn't actually have a confirmPassword attribute, so it's odd if you're not seeing an exception thrown here (are you using devMode during development?). But regardless, the code is not going to work as intended.

Note that you also can't do $user->addError('confirmPassword', ...) – again, since the user model doesn't actually have that attribute; the addError() method only works with actual attributes.

Assuming confirmPassword is the name for an input in your registration form, you'll need to change your code to something like this (personally I think an if/else statement makes sense here, since you can't set separate errors on the model for the password and the "confirm password"):

if (mb_strlen($user->newPassword) < 8) {
    $user->addError('password', Craft::t('yii', 'Password must be more than 8 characters.'));
    $event->isValid = false;
  } else if ($user->newPassword !== Craft::$app->getRequest()->getBodyParam('confirmPassword')) {
    $user->addError('password', Craft::t('yii', 'Passwords do not match'));
}

Beyond this, while doing custom validation in an EVENT_BEFORE_VALIDATE event handler should work, the recommended way to do custom validation in Craft is to add Yii validation rules via the Element::EVENT_DEFINE_RULES event. Check out this page in the official docs.