It takes over 100 hours to brute force a 4 digit PIN.. I'm not impressed. For further security, everyone should use a longer PIN along with Touch ID, that is what I do.
The number pad presented resembles a standard DTMF keypad. Which means that it also has all the letters on it. Some people might prefer using those to numbers. E.g. a long time ago a friend had a phone number of "tinyhat". Much easier for me to remember, even after nearly 40 years, than the 7 digits that translated to.