On the official web site it says that Payment ID
consists of 32 bytes (64 hexadecimal characters) or 8 bytes (in the case of integrated addresses).
Can it be less? If no, why?
I'm pretty sure the payment id can be shorter, and it is simply padded if it's too short. That said it shouldn't matter too much as it is encrypted so only the sender and receiver knows the contents.