Brute forcing the lock code has become incredibly hard since android 7.
After 5th and 10th incorrect authentication attempt, there is a timeout of 30 seconds. Every successive attempt up to the 30th gets the same timeout. Between 30 and 140 attempts, the timeout grows in an exponential manner from 32 seconds to 17 hours 4 minutes. After 140 attempts the timeout for each incorrect attempt is 1 day. A brute force attack against a 4 digit PIN would take around 27 years to complete.
It's still recommended to use 6-8 digit PIN. People keep weak 4 digit PINs.
After 5th and 10th incorrect authentication attempt, there is a timeout of 30 seconds. Every successive attempt up to the 30th gets the same timeout. Between 30 and 140 attempts, the timeout grows in an exponential manner from 32 seconds to 17 hours 4 minutes. After 140 attempts the timeout for each incorrect attempt is 1 day. A brute force attack against a 4 digit PIN would take around 27 years to complete.
It's still recommended to use 6-8 digit PIN. People keep weak 4 digit PINs.
