"Blocking all subnets of 172.16.0.0/16 major network with a mask lower than 23 from coming in" would block 172.16.16.0/20. The first prefix-list "ip prefix-list PL-1 deny 172.16.0.0/16 le 23" means "all networks that fall within the 172.16.0.0/16 range AND that have a subnet mask of /23 or less" are denied. The second prefix-list "ip prefix-list PL-1 permit 0.0.0.0/0 le 32" means allows all other prefixes.