PIN code lengths of five, seven, or eight+ digits are indeed good because they're nonstandard, which will combat PIN recycling. Any other justification seems to fall short.
PINs should always be implemented with a limited number of attempts allowed, banning automated PIN entry. The iPhone, for example, can be configured to wipe itself if you fail to enter your PIN ten times between unlocks. Banks will lock your account after a certain number of attempts. This isn't always the case, but I consider it necessary to counteract the ridiculously weak security PINs provide.
We're talking about trivial offline or automated cracking:
For a properly secure digital code, you'd need 14 digits for an offline crack time to exceed a year, and that's assuming something robust like PBKDF2 (this chart assumes PBKDF2 with a speed of 300k guesses/sec) rather than the vastly more likely plaintext code storage.
To this question's point, making it harder to map codes is better, as people so often conflate "random", "arbitrary", and "obscure", then fail spectacularly at estimating what is or is not obscure.
PINs with five or seven digits may avoid current patterns with four or six digits, but as kenlukas's answer points out, this will simply shift what people choose in their bad attempts at obscurity, such as postal codes or dates. There are 75% odds of a date that fits
ddmyy) since there are only three months that miss (365 minus the days in October, November, and December is 273, 273/365 = 75%). Increase that to allow
dmmyy and single-digit years between 2000-2009 and it gets worse.
An attacker can guess a ZIP code, for example, by using its ordered structure; if you're from a rural state or large metropolitan area, your ZIP code can be guessed in a few guesses because all codes in the area are similar. ZIP codes are therefore extremely insecure. At least with a
mmdd code, there are 365.25 possibilities, though attackers will start with your and your loved ones' birthdays and anniversaries.
For dates, a six-digit code's 1000000 possibilities get reduced to 36525 and a birthdate can be narrowed to 1826 assuming you can guess the person's age within a five year span. (Five digit variations actually introduce complexity here, but it's not much.)
Seven-digit PINs will bring in the possibility of childhood phone numbers, which are at least harder for an attacker to socially engineer (especially for retired numbers).
Still, more is always better, so moving a requirement from four to five is great, but you might as well go to six. Aspire to longer codes barring compatibility concerns (I remember a conversation in 2002 in which a friend couldn't use their bank card in Europe because that bank didn't support six-digit PINs).
I'm hoping PINs fade away thanks to 2FA solutions like TOTP and HOTP, but I expect that transition to be slow and legacy support will continue for another decade or two.