Is there any direct way to ask all registered onion addresses from Tor directories? If it is not available, it should be bruteforced for specific ports? I mean all 16 chars onion addresses should be pinged for specific ports?
Tor directory authorities don't keep onion addresses. It is Hidden Service Directory which keeps descriptors for currently running onion services. As they are responsible for holding descriptors, malicious HSDir can harvest onion addresses from their descriptors by deriving them from their public key.
Harvesting onion addresses from HSDir violates Ethical Tor Research Guidelines so they will ban you once they find out.
TorProject is actively monitoring such activities to block malicious HSDir. As mentioned in NorthSec: David Goulet - Deep Dive Into Tor Onion Services they are using some clever system to detect that which they keep it hidden because they don't want malicious HSDir to find a work around and start harvesting onion addresses without being detected. Malicious HSDir are getting smarter. They don't visit those onion addresses as soon as they harvest it. They wait for sometime and pretend to be as client to trawl onion services.
People have actually started making business models on this so TorProject has decided to end this. Harvesting onion addresses has been addressed in Next Generation Tor Onion Services so you can no longer harvest onion addresses by hosting your own HSDir anymore.
There are hidden services who don't want to reveal their onion addresses. HSDir are sitting at a position where they can index onion addresses from their public key. There is no other way except by bruteforce which also doesn't work in next generation onion services in which size of onion address is 54chars. Such HSDirs often get blocked for being acted as malicious.
As with the actual answer, it is possible but is against TOS for unauthorized individuals, the project is designed for the absolute protection of free speech which would be undermined by such actions. citation needed
Imagine you're at a rally with 1000's of protesters who are peacefully protesting but happen to be wearing masks so they can return to work the next day without having to worry about being fired for voicing their opinion, sure you could brute force and trample their rights but if they did nothing wrong you're putting them in more danger than what they imposed.
Subnote as noted if there are cases that need to be handled the Team keeps a fair unbiased handle on the situations whether it be those abusing their anonymity or those trying infringe on privacy (ex. the bruteforce identifying OP mentioned)