Also, to mitigate the problem somewhat, one could obfuscate the order at which the numbers were pressed by setting a custom pin with repeating numbers. Ideally, just repeating one./s

I have already seen some ATMs that shuffle the numbers on the numberpad around for each PIN entry. It is inconvenient for muscle memory, but prevents this kind of attack.

I know somebody working at a bank talking about their implementation, and how many elderly customers block their cards after wrongly entering their pin.