SPI Reading memory over SPI with Bus Pirate
The 'r' command for bus pirate reads a single byte, so r:16 is attempting to read 16 bytes, not 16 bits. I'd guess you want "r:2 r:2" (or just "r:4")

But, I doubt that's the problem. If it had worked, you'd have seen the 4 bytes then some FFs.

I think it's more likely that your chip is not ready to accept commands over SPI.

I did some work with the CSR BC04 a few years ago. They can be configured to accept commands over the UART, SPI or USB. It's possible that yours isn't accepting commands over SPI. Fixing this may involve reflashing the firmware.

You might give the Bus Pirate SPI sniffer a go and see if you can intercept some valid looking signals when your device is running normally. That would give some confidence that it really is using SPI. Another way to do this would be to use a 2 channel oscilloscope, trigger on CS and look for the SPI clock ticking while CS is asserted.

To be honest, if you're just trying to get SPI going on the Bus Pirate - choose something easier. The first device I used mine on was an RGB LED matrix from Sparkfun.