Just to chip another little piece off, ascii is a 7-bit encoding, and the 8th bit is clear, so that makes 16 × 7 = 112 bits if we use any ascii byte (0..=128).

I'd count 6 bits per letter (64 different characters) as a rough estimate for realistic passwords.

English text has 1.46 bits of entropy per character.

https://www.gwern.net/docs/statistics/1996-teahan.pdf

You wouldn't use english text for the password, for this reason.

That’s why I, in the EDIT, then chose to assume 2^5 different characters, which is roughly lowercase ascii plus some special characters.

That’d still be 80 bits, and still secure enough.

An 80 bit password would be secure. In fact, now that I am aware of this issue I generate the master password for Thunderbird with PfP: Pain-free Passwords and it's in fact around 80 bits strong (too bad that I cannot use PfP in Thunderbird directly). But if you as a human choose a 16 characters password you will get far less than 80 bits. Passwords chosen by humans follow known patterns, use dictionary words etc. Which is why password cracking applications won't stupidly test the entire password space - they will go for passwords that humans are more likely to choose. Fact is, for a human getting significantly higher than 40 bits while still being able to remember the password is very hard.