So backups are insecure because they can be brute forced then?

Most PINs are 4 digits, and 50% of people use the most popular 25 PINs.

Pattern has 9! combinations (= 51840) but most people use four dots (987*6 combos) and most of those probably use one of a few popular patterns.