How do you figure?

My threat model includes people stealing the card. I can have tap disabled on the card, and then thieves don't know my PIN. Yes, yes, that's like 13 bits of entropy. But it's not like they can use a computer to brute-force it.