Is that a problem that needs solving? Most interfaces for entering a user-generated PIN, like an ATM, are heavily monitored and rate limited. It's not like back

Is that a problem that needs solving? Most interfaces for entering a user-generated PIN, like an ATM, are heavily monitored and rate limited. It's not like backend databases are routinely encrypted with these. As others have said, increasing the length would do little to increase security in most cases since the usual response will be to repeat digits. Plus the current system seems to be working pretty well empirically. This reminds of the password rotation policies that some companies insist on using, despite the evidence that they are a waste of time. In practice they are an "Increment the last digit of your password" policy.