Is the limitation of 8 decimal places a protocol one or a client one? If so, why?
A protocol one, but it's not a particularly interdependent design decision. The bitcoin balances are stored as integers (64 bit, I believe) and the decimal point is centered by the client for human readability in base 10. It could be changed to a larger integer without a great deal of technical fuss, but that would require the general agreement of the entire running network. So it's more of a political problem than a technical one.
I know that 8 decimal places is MASSIVE, but I'm just wondering why since it's inexpensive to have 16 decimals.
As noted above, bitcoin actually does use 16 places in base 10; so the next step isn't quite so inexpensive as one might imagine, because it involves stepping up to an 128 bit integer, at a minimum.