People tend to get lost in mathematical technicalities in these discussion. Yes, even really dumb limitations leave 100k+ possibilities open, much more than you can brute force with a three-strike-lockdown. But that's not making it ok. Even if some crafty hackers on the other side of the world find a way to crack my account I'm confident the bank will look at the possible PR and legal costs and just refund my money fully, yes, yes, wonderful. That is not the problem.
The problem is user inertia. Let me speak as an averaged one, mixed with my own deeds prior to being knowledgeable in cyber security.
If I'm forced to remember my password because my password manager gets shut out or because of weird requirements, like uppercase letter + two numbers + non-alphanumeric, I'm nudged to use the same variation of my "default password" I used before, 27 times.
"DognameBirthyear&".
"+KeysThatAreCloseOnTheKeyboard1234+".
And of course, I use a slight variation of that for everything. Shady web-server-under-the-desk web forum in 2007 three of my friends were on. Indie game servers, another classic. Bank. Google. It also was my facebook password which I gave to my bff once to check if that cute boy really liked me. It also can be guessed by obtaining my ID and watching me super slowly type the added non-alphanumerical at the end.
This opens the very real possibility of revenge of ex partners, witty people at the coffee shop gaining access and the like. Crimes are committed overwhelmingly by people knowing the victim. No fancy AI is gonna help you with that, reasonable withdraws in the middle of the day in your time zone from your own MacBook's IP address. Good luck with customer support. You are enabling THAT with your dumb requirements.
And why?? You are a bank, hire someone who knows their job and does not just act on blog spam FUD or whereever you got the idea of exactly 5 digits numbers only. No, I choose to be mad about this because there is no excuse for such horrifying UX and security.
Just enforce a minimum limit of like four characters to prevent breach by putting down coffee mug on keyboard, enforce a maximum limit so you don't fall victim to an embarrassing flavor of DOS attack. If you feel fancy, throw a bunch of money at haveibeenpwned to check whether people are putting dumb passwords and let your local RegEx wizard check against all other silliness. There you go. I even waive you the $150k fee for that extraordinary piece of consulting.