keep in mind, there is a difference in base58 prefixes and h160 bits. It feels like you are mixing the two up/together.
I'm not mixing anything.
These are all (and only) the possible H160 values that convert back to a "1PWo3JeB9jrGw" address prefix.Unfilled base58 digits: 21
Adjusting min H160 up from "1PWo3JeB9jrGvzzzzzzzzzzzzzzzza76BM"
min NB+H160+CS: 00f6f5431d25bbf7b129329c4be9ce9c7064f457fc76e8cd54 len: 25 minAddr: 1PWo3JeB9jrGw1111111111111117sfssh
Address right before the computed minimum: 1PWo3JeB9jrGvzzzzzzzzzzzzzzzza76BM
max NB+H160+CS: 00f6f5431d25bbf7b1314bbfcb22658f6370ac8ac91e478669 len: 25 maxAddr: 1PWo3JeB9jrGwzzzzzzzzzzzzzzzwVNymA
Address right after the computed maximum: 1PWo3JeB9jrGx11111111111111163WUG8
H160 target prefix len: 67 bits
Total possible H160: 2506270853702237716179595982 = 91.01760089767902 bits
Expected average in subset: 2.02
99% confidence interval: [0, 6] successes
And matching the first 67 bits in the RIPEMD hash yields
Total possible H160: 9903520314283042199192993792 = 93.0 bits
Expected average in subset: 8.00
99% confidence interval: [2, 16] successes
Hence, matching H160 prefixes will provide many results which don't result in the 1+12 b58 prefix. Simply because most of those fall below and above the min/max BOUNDED H160s that convert to the desired base58 1+12 prefix.