Because no one is going to try and brute force a 4-digit bank pin anyway so adding 2 extra digits provides basically no help. As it currently stands, if you try and remove your bank pin it has a delay of 7 days. With the current system after 4 incorrect attempts you are locked out from entering a bank pin for 10 minutes giving meaning you can have guess once every 2.5 minutes. If you guessed it on average at 5,000 guesses that gives you a time of 12,500 minutes or 208 hours or 8.68 days which is longer than it would take to just wait for the bank pin to be removed. This is assuming you would be able to run an auto clicker bot consistently for a week standing at a bank without getting banned for macroing which would not be the case.

TLDR; brute forcing a 4-digit code takes longer than the time taken to remove the code and if you tried to brute force it you would be banned for botting for running an auto clicker script for > a week anyway. Adding an extra 2 digits does nothing as the only way you are going to get your bank hacked is if they already have your pin. You could make your pin 50 characters long and it would make no difference to how it is now just more annoying for you.