iOS and MacOS have an application named Notes which allows to encrypt any note with user-chosen password. Apple states that "When a user secures a note, a 16-byte key is derived from the user’s passphrase using PBKDF2 and SHA256". They don't mention anything about the salt length or the number of iterations unfortunately, thus making it hard to assess the security. Has anybody more information? I actually thought the output of SHA 256 was 32 bytes, so Apple is making less secure here, isn't it?
Using a 16-byte key just means they're using AES-128 rather than AES-256, which is still plenty secure. It doesn't matter much anyway since the key is being derived from a password; a 32 byte key is only more secure than a 16 byte key if it contains more entropy (which would be the case if it was a random key), but your password is unlikely to contain more than 16 bytes (128 bits) of entropy (I'd be surprised if it was even half of that). The way this will be broken is by brute-forcing your password through PBKDF2, not by brute-forcing the key directly.
What I find much more concerning is this:
Users who forget their passphrase can still view secure notes or secure additional notes if they enabled Touch ID or Face ID on their devices.
While that's certainly user friendly, it sounds to me like they must be storing the derived key, which is generally a bad idea. This risk is probably mitigated by using a secure element, but it's still a risk to be aware of if you use Touch ID or Face ID.