That seems like an insane security hole really.

One of the big distinctions I make in my life is whether a passcode is being typed in frequently and in view of the public. And since these are shorter codes, the entity on guessing from a distance is much lower.

The even more insane security hole is allowing someone with physical access and the password to permanently lock out all recovery options.