Maybe it was just a mistake and they intended to generate a `--bitsize 4` thinking it was in kilobyte units.

shrug

I think they're just absolutely inept and should never be trusted with anything security related as an organisation if this is a mistake they could make.