If the boundary is not set, a user can enter a longer kennitala, and just as long as the check digit is at the right location from the end of the string, the kennitala is valid.

Example:
This kennitala is valid without this fix: 28129420229.
It's obviously not valid, beacuse it is 11 digits. But since the regular expression is fine with matching the first 10 characters, and then just checking the check digit at the [-1] location, it passes as valid.

With this fix, this kennitala would not pass the boundary check, i.e. it must be 6+4 characters (optional hyphen) and then a boundary, e.g. end of the string.