The NFPA (National Fire Protection Association) doesn't decide how many inputs or outputs can be on a fire alarm panel, and they don't decide how many zones we can attach to a fire alarm control panel. These decisions are left up to the manufacturer of the panel.
The NFPA, however, does indirectly control how well the panel is going to work. Once the panel is designed and ready, the manufacturer has to get the panel tested by a third party, nationally known testing laboratory like UL, ULC, FM, CE, Etc. The tests are performed using NFPA rules. Once the panel has been tested to work, and listed by the laboratory as being a functioning Fire Alarm Control Panel, then the manufacturer can sell it.
The NFPA doesn't put a limit on zones. High-rise buildings can have conventional fire alarm systems with 40 to 100 input zones and that many output zones. Addressable fire alarm systems that use each device as an input or output zone can have thousands of input and output zones.
The number of input zones and output zones is really determined by what is needed in a building. The panel and the zones on the panel, then, have to match the building.