This seems more like a UI bug that Apple needs to fix. If the UI doesn’t give any indication of how many digits are expected and _always_ allows me to input bot

This seems more like a UI bug that Apple needs to fix. If the UI doesn’t give any indication of how many digits are expected and _always_ allows me to input both numbers and alpha, then no one can guess these things. Instead there are 4 separate UIs here: 4-digit, 6-digit, 7+ digits, alpha-numeric. Each of them gives an attacker lots of hints. Insecure by design.