Yes, most things are possible - and allowed - with SPI. And no standard organization (or copyright, trademark, ...) to limit what is allowed.

Most SPI controllers are unable to communicate in other chunk sizes than 8 bits. Some SPI controllers can do 16-bit or 32-bit communication (including internal byte-swapping) to allow simple transfer of larger data types. A few SPI controllers do have the ability to specify a specific bit count out of a 8-bit, 16-bit or 32-bit integer written into the send register.

But to not force people into having to switch to bit-banged communication, companies producing SPI peripherials really have to think very much about using transfer sizes that are not a multiple of 8 bits.

On the other hand - there is absolutely no limitation to what the actual bits will mean when doing SPI communication. Every single device may be totally unique. This is not a problem since you normally talk with only one device at a time, and any other device will ignore anything on the signal lines. In some situations my may talk to more than one slave device (but limited to one-way communication) but in that case the separate slave devices just has to use an identical protocol.