Sure, my point is just that a server-side check is immune to attack (assuming the server is not compromised.) A client-side check is subject to other exploits allowing the attacker to get around it.

Either way, you're right, it's pretty much a given that brute forcing a 4-digit passcode in iOS is far from easy, regardless of context if the developer knows what they are doing.