Thats assuming that all attempts take a fixed amount of time and there is no lockout feature implemented. If google hasn't implemented this then this would be trivial to implement so that your pin code takes far longer than 18 minutes to crack.