Thanks for your feedback and for recruiting! We didn't pick 16 characters because we thought it would be super secure, we picked it because it is the minimal level of security that doesn't require users to backup anything else and doesn't make us responsible for securing user data.

Unlike traditional services, the "password database" of Steem is public. This means hackers can trivially brute force passwords against any account they like. Normally each password submission must go to a server and the server can rate-limit hackers. With Steemit your password is your private key. Attackers can try millions or billions of passwords per second. An 8 character password could be brute forced in a couple of days assuming it was perfectly random.

A 16 character randomly generated password containing upper and lowercase letters and numbers contains just 96 bits of entropy. Normal private key security requires 256 bits. Keep in mind that each bit of entropy DOUBLES the security and you will see that a 16 character password is actually incredibly weak.

In 2007 there was estimation that cost to crack 88 bits using brute force is $300M if you apply Moore's law you reduce this price by factor 16 or you might get 4 extra bits by now.

All of that said, just because it is difficult doesn't mean we shouldn't attempt to find a better solution.