Can a smartphone's PIN or password be brute-forced in an offline attack?

Ciro Santilli has a hard time understanding why this is possible, e.g. many people use short 4 digit pins, or a short swipe pattern. Why can't this be cracked easily offline?