While that may seem like a lot of iterations, in reality it doesn't take that much time at all, at least in my experience.

You could argue a security product shouldn't let folks set a PIN due to footguns like this and instead require something like WebAuthn for an "easier" login method.