I thought the limit was 20 cores, not 16.

But if SQL can see 20 cores, but only use 16, you still need to licenses all 20 cores as it is what the server sees what needs to be licensed, not what it is using.