If they can find your pin, why can't they find your passphrase?

Think of your pin as your passphrase and its as safe as your passphrase. Treat your passphrase as badly as you treat your pin, and its as vulnerable as your pin.

The pin is up to 6 (or is it 8) characters long, that's a lot of brute forcing. PLUS:

1. The anti maid attack feature where it has you confirm some words based on your device and first half of your pin protects you from giving your pin away to a malicious hacking device (physical phishing)

2. The kill-myself feature prevents someone from using brute force to break in way before they have tried enough times to have broken your pin, even if it were just 4 digits long.