A PIN just got 10000 possible combinations, while a fingerprint got many more.
If there's a 4-digit PIN, people could just bruteforce this pin instead of bruteforcing million of fingerprints, couldn't they?
Biometric lock is weak, hence insecure - it's only for user's convenience.
PIN can be generated from set of 10 numbers - it can be with or w/o repetition.
Password (on factory Android) can be generated from ASCII charset, including numbers, without control chars - c < 32 || c > 127, thus having 94 printable chars.
Again, minimum lock screen length is 4 && maximum lock screen length is 16 (on factory Android).
Also, default password policy is PASSWORD_POLICY_UNSPECIFIED (on factory Android).
With that said, factory (AOSP) Android has low security margin; it is only on user to define password with complex quality thus to mitigate online attacks (bruteforce).
Off course, you can change policies with DPM (DevicePolicyManager) application or build custom ROM.
Regarding your q about bruteforcing, I suggest to read this