When the geocoder dijit has the auto-complete property set to true the geocoder calls the suggest operation in REST. This operation does not support the maxLocations parameter. If you examine the JSON request you will see the maxLocations parameter is passed to the service. Examining the JSON response will show that 5 locations are always returned. The maxLocations parameter is ignored by the suggest function. The maxLocations parameter controls the results of the find operation in REST. Run your application with auto-complete disabled and maxLocations set to 25 then search for a city. Examine the JSON response and you should see more than 5 address candidates displayed.
You can view the documentation for the suggest operation here:
suggest—ArcGIS REST API: World Geocoding Service | ArcGIS for Developers
And you can compare it to the documentation for find here:
find—ArcGIS REST API: World Geocoding Service | ArcGIS for Developers