Hostile mobs can spawn at max height at any time, day or night.

Likely because y=256 is not a tracked block, there is no associated light value. Thus a null value is being passed for the light value. For integers, the turns out to be a 0, which would indicate allowable spawning positions. Suggest that light levels for blocks where y > max_height return the current sunlight level.

Easily verifiable using the Superflat worlds (just ensure blocks are up to 255 or server max height).