There is no real limit on the amount of stored programs you can have on a commlink or cyberdeck.
The only limit at play here are the amount of programs you can run at the same time.
If you spend one of your active program slots to run Virtual Machine then you get two more active program slots (a net gain of 1 active program slot). The disadvantage is that your device take one extra box of matrix damage each time it take matrix damage for as long as you choose to run the VM program.
Edit: Slipped by SSDR.
In the case of programs/cyberprograms, there's little reason to NOT just buy each and every one of them in the book... and pick and choose which ones you need at any given moment.
Note that there is probably no real point in storing Biofeedback, Blackout, Exploit, Lockdown, Stealth and Trace on our device unless it is a cyberdeck.