There's nothing wrong with allowing a 4-bit passcode. The problem is that you're claiming "no one, not even SecureAppy can unlock or see your data" which is jus

There's nothing wrong with allowing a 4-bit passcode. The problem is that you're claiming "no one, not even SecureAppy can unlock or see your data" which is just not true when the user uses a 4-bit/6-bit passcode. Apple doesn't claim that. Not only should you not make a misleading security claim, I think the risk should be clearly communicated when users choose those options. The encryption may very well be sound, but it's only as strong as the passcode.