You're absolutely right.

A worse example, pharmacy.amazon.com only uses a 4-digit passcode to log in, and it's a pharmacy site!