Brute-forcing the key vs brute-forcing the password
Brute-force the key
To brute-force the key directly I need to keep guessing keys and attempting to decrypt the encrypted file with it until eventually the file decrypts properly. Without any extra information, I need to try the 2128 possibly key values at random.
On average I will need to do 2128 / 2 = 2127 guesses. By the way, this is a massive number! Physics reduction: one ARM assembly instruction (ADD, SUB, XOR, ...) consumes about 300 pJ ~= 3.0x10-10 Joules per instruction on a low-power embedded device. The sun contains roughly 1.2x1044 Joules of nuclear fuel. Assuming we could guess a key and try decrypting the file in a single ARM instruction (which is bananas, you're looking at millions of instructions for a reasonably-sized file), then doing this brute-force attack would require consuming 2x1015 stars! Yeah, 2127 is a massive number. Good luck with that brute-force attack. Hope you have a good electricity rate.
Brute-farce the password
The length of the password is only relevant insofar that a 16-char password has more possible combinations to guess over than an 8-char password. While your 16 character password may require 128 bits of disk space, it is certainly not 128 bits of security. For starters, there are only 95 printable ASCII characters, so for a password that only uses keyboard chars (no accents, emojis, etc), at best you're looking at 9516 ~= 2105 possible 16-char passwords to guess. On top of that, we know that 30% of accounts on the internet have a password from the top 10,000 passwords [source], so the length is actually irrelevant if you're one of those 10,000.
Putting it together
Brute-forcing the password, if this is some random internet user (ie they are inventing their passwords the way the average internet user does), then you have a 30% chance of cracking it in the first 10,000 guesses. If I'm brute-forcing the key directly (without using any extra knowledge), then I have a 0.0000000000000000000000000000000003% (3x10-35) chance of cracking it in the first 10,000 guesses.
Basically, passwords are weaker than keys because human brains are stupid and predictable. If your password came from a random generator, then this is a completely different story because it's really more of a key than a password.