But, yes, it is bad practice and lazy. They could trivially have a "phone pin" or just verify security questions over the phone like almost every other bank on the planet.
As nodata quite correctly pointed out, it could be made secure by locking out your account after a very short number of tries (e.g. 5). Then requiring telephone or email verification to re-enable it. That would stop brute force, dictionary, and distributed versions of the same from effectively working no matter how small the password space is.
In my experience companies who enforce things like a 6 character password are not the kind of who will sit there and calculate out the attempts/minute and "time to break (TTB)."
Plus the thing they said about their virtual keyboard shows utter ignorance and incompetence. Professional keyloggers don't literally log your keys! They hook into the network stack or browser and literally grab completed POST HTTP/s requests, so a virtual keyboard adds nothing at all security wise (and arguably makes it easier for someone to shoulder surf you, even if that threat is highly overblown and rarely exists).
So, yeah... Good luck convincing them. Whoever works there and making security decisions clearly is incompetent and it will likely take internal rather than external pressure for that to change.