Most enterprises require a 12 digit code, to meet a specific security standard. Bruteforcing that, with hardware access restricted by TPM, would take a very, very long time.

You're also not restricted to 4 digits. A full passphrase is an option.

The time limit is enforced by the TPM itself which defends against tampering.