It doesn't limit it to that, it defaults to that.

You can use a longer alphanumeric pass code if you'd rather, it's an option in settings.

As with all security convenience is played off against security. For most people (who in reality aren't likely to be targeted by such an attack and aren't storing much in the way of critical data on their phones) a four digit pass doesn't seem completely unreasonable.