It's not really an attack.

Pin is obviously less secure (however this could be mitigated by using a TPM as other commenters said) but it's not the default.

Their help page on pin even warns about the security risk, they should have the warning in the application.

I'll still use bitwarden (without pin).