A 4-digit PIN is sufficient to lock the phone to prevent a thief from getting at your apps until you can remotely wipe it. It's not nearly sufficient to protect the billing area of a website. You're right, they're wrong. You need to find another carrier, one who cares about security.