In most cases the issue isn't character limit but the password itself, people like to pick passwords that are easy to remember which makes them easier to guess.
Other "common" passwords are grand-children's names, and pet's names.
Passwords shouldn't be real words, but if they are they should be mixed upper and lower case, maybe mixed with numbers within.
You have 52 alphabet characters, 10 numbers, maybe 10+ special characters, most banks and such give you three "tries" then you are locked out.
Too many want to use the same password for everything so it is easier to remember, sometimes they will even use the same screen name too.
Those with the resources to "brute force" a 16 character password are not going to waste the time required on a personal bank account, those are usually guessed or the person is tricked into giving it out.