Even at 8 digits people could still use their birthdays. I think there's a tradeoff between PIN size and fraction of the population that will feel comfortable picking a number with no significance. I'd speculate that in a world where every PIN has to be 16 digits that almost everyone would just use 2 or 4 concatenated dates.

That's why you need an odd number. ie 5. Or 7 for higher security.

Most of the time they do the trick (when rate limited). Even using a birthday will still stop card thieves from emptying your bank account at an ATM.

I'd hazard a guess that asking for an 8 digit pin will see lots of people just repeat the first 4 digits again.

Is that a problem that needs solving? Most interfaces for entering a user-generated PIN, like an ATM, are heavily monitored and rate limited. It's not like backend databases are routinely encrypted with these.

As others have said, increasing the length would do little to increase security in most cases since the usual response will be to repeat digits. Plus the current system seems to be working pretty well empirically.

This reminds of the password rotation policies that some companies insist on using, despite the evidence that they are a waste of time. In practice they are an "Increment the last digit of your password" policy.