There is usually a little more indirection, like buying a fuckedcompany with a /16.

Not any more. Within the ARIN region it's legal to straight-up sell addresses as long as the buyer is actually going to use them (people argue about this point a lot but it doesn't seem like a big deal IMO).

Where is this done now? I would be happy to pick up a /16 for a project.

https://www.arin.net/resources/transfer_listing/index.html https://www.arin.net/resources/transfer_listing/listings.txt http://addrex.net/