The PIN doesn't have to be long because the key will block itself after a very limited number of attempts. Just like with your bank card.

Extracting the key is another issue but the chips used in these are hardened. They are just like the secure element in phones.