Pgm pointers are 16-bit word pointers.
Well, not quite. The flash memory is organized as words, and program instructions are always aligned on a 16bit boundry. The "jmp" and "call" instructions do not include a bit that differentiates which byte, so in theory a "pointer to function" could be a word pointer that addresses 128k of memory. The bootloader and programming protocols use a lot of word pointers, which is why "burn bootloader" starts to require different tools beyond the 128k (byte) barrier rather than the 64k barrier.
However, the indirect jump (jump to the address contained in a register) AND the "load program memory" instruction (for reading data from flash) both take a full 16bit byte pointer; the low bit is ignored for the ijmp, and does bytewise addressing for LPM. So most actual pointers really are byte pointers.