Small codes need a surrounding defense
Four unconstrained digits have exactly 10,000 possibilities—about 13.3 bits. Six digits have a million, about 19.9 bits. These are code spaces, not strong standalone passwords. A device or service must limit failed attempts; generation alone cannot provide that protection.