A database of of 4 digit passwords is not suitable as a replacement for PINs. Especially not for anything called a fucking analysis.

Banks don't let you choose 4 consecutive numbers or 4 of the same number making his first conclusion completely invalid. A lot of banks assign pin numbers now making the rest of his conclusions invalid.

I get wanting to analyze PINs, it's interesting, but pretending any old data that looks similar will work is misleading, disingenuous, and half ass.