Probably can be brute forced within milliseconds. With that sort of design decision I would guess there would be other gaping security holes that would make even brute forcing the PIN an overkill.