Yes and no :)

You are limited to 20 database session, but there's not a 1:1 relationship between application users and database sessions. APEX uses connection pooling.

So when a user logs in, the app briefly uses a database session to authenticate them and load the homepage. This session is then released back to the pool. It's only used again when they do something that accesses the DB in the app (submit a form, load a new page, filter a report, ...).

It's not like a car where someone stays in their seat for the entire journey, so you can have e.g. 5 passengers max. It's more like musical chairs, but everyone is listening to their own music which starts and stops and different times. Only a fraction of the people are sitting down at any time, so many more people could be "using" five seats (as long as the music doesn't stop for them all at the same time ;)

Exactly how many users these 20 sessions can support depends on the app. If it's processing heavy, where most of the time is on database access, you may not be able to get more. But it's common for people to load a page and spend a few moments reading it before clicking; in these scenarios, 20 database connections could support hundreds of end-users.