There are escalating time limits on incorrect PIN attempts, which is also enforced in hardware by the Secure Enclave in A7 chips and above. This would mean even breaking a 4-digit pin code without that delay being removed would take a long time. Additionally the device may be set to wipe after 10 incorrect attempts.
Secure Enclave is _not_ hardware; despite being isolated from the main OS and CPU, it is still software-based and accepts software updates signed by Apple.
Attempts | Delay
1-4: none
5: 1 minute
6: 5 minutes
7-8: 15 minutes
9: 1 hour
Source: https://www.apple.com/business/docs/iOS_Security_Guide.pdf