If the validity of the code is not limited in time, and the number of retries is unlimited, and the tries are really fast, then no, it is not really secure.
If the number of tries is limited to three, and the code is valid for 5 minutes, then it might be OK-ish.
But as always, what are you trying to protect. For access to subscription newspapers, this is sufficiently secure. With three retries, the chance that someone reads an article without paying for it is lower than 1 in 300 000. As a permanent access code to nucleair launch codes, without additional measures, it is probably not sufficient.
The places where I have seen this pin-code type of security, there was always some additional set of measures:
- the previous mentioned retry limit
- the time limit on validity
- the fact that the code is sent to an already known e-mail address (If you did not request this code, please contact our helpdes