This is about a misunderstanding. RC4 is a stream cipher. That means that it takes an (input) key and generates a key stream. The bits of this key stream are then XOR'ed with the plaintext. The size of the key stream is not dependent on the size of the (input) key. The input key is not XOR'ed with the plaintext.
Generally RC4 implementations only handle bytes. That's OK, you can just give any input key you want between 40–2048 bits in steps of 8 bits.
Then you can encrypt with the resulting key stream, which means the XOR'ing with the key stream. You can just use 3 bytes / 24 bits of plaintext: say one byte with the least significant bit set (the other bits can have any value) followed by two bytes with the rest of the 16 bits. Then you encrypt those bytes.
Finally you retrieve back the 17 bits at the same position. Now you've encrypted 17 bits; the other 7 bits can be ignored or removed. When XOR'ing the bits of each byte are fully independent of each other, so the other bits are not needed.
Decryption is identical, so you can just ignore the same 7 bits again.
As indicated by others, RC4 is not considered secure. There are plenty of stream ciphers to choose from that are secure. You could also use AES in counter mode, although AES-CTR obviously does have specific input key sizes; the key stream will however work as expected.