That's not really what the CVV2 number is for -- it's not a password for your credit card.
The purpose of the card security code is to indicate whether or not the card is present during the transaction. If the card is not present, then the transaction MUST be submitted without the verification code. In fact, if the card company finds out that you store this number in any way, then big fines for you.
So instead of simply asking, "Is the card present: yes/no", the card companies make you type in a number found on the card. It keeps people from giving the wrong answer. It's a bit like saying "ok, if you have the card in your hand, then quick, tell me what color it is." The information is not at all secret: it's printed right there on the card. It's trivial to obtain if you ever have access to the card. So making the code longer doesn't really change anything.
Most importantly, if you don't actually have the number on hand, then the most effective thing to do is just submit the transaction without it. If you send the transaction with the number, your transaction will probably be accepted. If you send the transaction without the number, it will probably still be accepted. But if you submit it with the wrong number, then it will always be rejected.
So playing the numbers game, your chances of the transaction being accepted are higher if you just ignore the CVV2 number than they would be if you randomly guessed at it.
And since every transaction attempt is recorded by the card company, you can't really mount a brute-force attack on it either. Too many incorrect guesses and your your merchant account could get flagged. Then the whole game is over.