I agree with you. Short PINs are for preventing well-intentioned people from accidentally using the wrong account (which I do consider quite valuable, for the record) - not for keeping bad actors out.