Depends on the attack vector
Hackers steal 45 million passwords. The six-digit PIN mechanism is immune to this sort of attack, because the PINs are generated on the fly and presumably have a short lifespan. There is nothing to steal.
How I'd hack your weak password. The six-digit PIN mechanism is immune to this sort of attack, because the user does not choose them, and they cannot be inferred from demographic information.
Brute force cracking. The six-digit PIN mechanism is not immune to this sort of attack, but the hacker only has a 1 in 1,000,000 chance of getting it right. Depending on the lockout mechanism that it uses, the hacker may have 3-5 chances, which still offers very poor odds.
On the other hand, you are in a less comfortable position if
- A hacker steals your email password
- A hacker steals your mobile phone
- A hacker is able to intercept your email because it was not sent securely
- A hacker is able to intercept your SMS, somehow....
There may be other, hidden security mechanisms
Payment processors tend to have additional security mechanisms that you can't even see. For example, your payment may end up going through a risk engine and will get blocked or sent to escalated auditing if it appears fraudulent (i.e. if someone is sending a lot of small transactions to one place, or if the IP address is in Syria, for example).
Who is at risk?
It may ease your mind to know that the security mechanisms in payment processors' sites are not so much there to protect you as they are to protect them. They are the ones who have to come up with the money if any of your funds are stolen. Your personal liability is limited to $50.