Except this thread isn't about blaming the users, but assessing the potential for improvement, where this simple mistake leads to inaction
So yeah, they should change the stupid name and be more clear that users should use letters as well, but it's still valuable to increase argon work factor parameters
If you call something a PIN, salted hashing is completely pointless (and software still doing it tells me that the vendor hasn't grasped this fact).
A Personal Identification Number typically has 10k (or less frequently a million) possible values. Hashing buys you a few seconds of brute force resistance here at most, which is completely useless.
If you dial up the hashing complexity enough to make a dent, even legitimate logins will start having an unacceptable UX and battery life impact. You're just on the wrong side of the e function with PINs.
> be more clear that users should use letters as well
The entire point of the feature is that the PIN, whether letters or numbers, is shorter and/or easier to type than your passphrase. If you require users to use something of equivalent security to their passphrase, you might as well remove the feature.
I don't know why your repeat the same mistake with 10k, "typical" doesn't mean you ignore the atypical, that's still a net benefit.
Your last point is also misleading - no, you don't require the equivalent to master password, and yes, it still makes sense in that case. "Shorter/easier" can still mean enough entropy for the smaller threat model of local compromise (with even more entropy required in the master password for the bigger threat of cloud compromise). It's when it drops down to the level of literal 4-number PIN, then it becomes useless against this threat and only useful for an even smaller threat
