It calls them “passwords,” but personally I don’t consider a 6 digit number to be a password. And according to this article on GrayKey, 6 digit “passcodes” became the norm back in 2015. I haven’t seen any stats showing that people on average use more secure passcodes now, and making the passcode required more frequently isn’t going to encourage anyone to use one that’s more secure.

The article just says “disable biometrics” which is bad advice for the average person, as it will result in them using a 6 digit passcode. This is a knee-jerk reaction at best, and the resulting advice is devoid of nuance, made by someone who clearly doesn’t understand the threat discussed in the article, and would benefit literally nobody who might feasibly take it.

My advice is echoed by the article above, but it’s based off having an understanding of the problem area and suggesting a solution that doesn’t just address one thing. Anyone giving advice on the topic should consider:

• known threats and reasonably likely unknown threats
• the mitigations to those threats
• how the technology works for both the threats and the mitigations
• the legal landscape in your jurisdiction - for us, the US - both in practice and in theory
• people’s attitudes toward security, namely their willingness to suffer inconveniences for its sake
• how all of the above interact, and how likely someone is to take the advice given in a way that improves their security overall

The author of this article considered none of the above.

He's not wrong though. Brute forcing number only pin takes little effort.