The point is that the attacker watches from a distance, and using the rough hand movements he/she has seen can reduce that 24 combinations significantly.
Hence why I prefer the smaller keypads on ATM machines, so I can minimize my finger movements. Having one keycode for the supermarket is also a good way for disgruntled former employees to act malfeasantly.
