Even if the PIN was only 4 digits you would be very unlikely to successfully bruteforce it. The TPM will throttle you after a few tries and lock you out for an

Even if the PIN was only 4 digits you would be very unlikely to successfully bruteforce it. The TPM will throttle you after a few tries and lock you out for an increasing amount of time after each further attempt. An attacker might get 10 good tries before continuing becomes pointless, so unless the PIN is one of 1234 4321 0000 1111 2222 you're probably safe. Note: TPM2.0 allows alphanumerical PINs but I think you need a group policy for Windows to allow it.