>> I verified this by writing a script to “brute force” the PIN number of my own account.

They need to turn on ip rate limiting to stop brute force attacks or make them impractical. At least that's my understanding of the purpose of rate limiting.