This isn’t really obvious. While there are clearly a limited number of codes with four digits, the idea is that the Secure Enclave can throttle and limit cracking attempts to the point that an attack would be infeasible.

Just checked. The default passcode on my iPhone 8 is a 6 digit numeric code, not 4. although you can switch to 4 it seems.

Even 4 digits could be enough, given that iOS enforces (very long) delays after a few failed attempts.