It's somewhat common to limit password lengths to avoid DoS attacks that exploit a slow key generation function.

But that limitation should on some hundreds or a few thousands characters. Sites that use limits like "16" are probably storing them as plain text.