But when you're accounting for brute force attack, you can lock out an account for a certain number of incorrect tries. A bot wouldn't have a chance to correctly identify the pin unless it ran the correct combination in the first 3 tries.

With the use of all alphanumeric chars - it would be even greater security. The only risk I see is if people consciously decided to use 111, aaa, bbb etc and those of the like.

But you can also block these pins from the jump so people can't use them.