How it should work is that one hash of your PIN is used to unlock the TPM. Then another hash of the PIN is used to mix into the key the TPM provides. That way directly compromising the TPM doesn't provide full access.
This is probably strictly obsolete by using a long PIN. But it feels nice to have a TPM, as it's one more piece the attacker needs. If they steal the disk or fuckup the TPM, then the data's gone, even if you reveal your PIN.
(ATM, I use Bitlocker, then encrypt my VMs with EFS keyed off a certificate stored on a smartcard. Then I Bitlocker the VM drive itself. It's silly, but that way I get a range of hardware plus brain-stored password. [I don't need it any more, it's just a leftover setup from my BTC experiments.] I also put tamper proof seals all over my laptop, but it requires active work to check them and note the serial number on each one.)