When the security word feature is on, once the words are shown you can’t delete digits to fix a mistake, you have to leave the screen and start over. Feels like a bug to me, but maybe it was an intentional design choice for some reason?
This is intentional when Security Words are enabled. Once the first four PIN characters have generated your Security Words, those characters are locked for that attempt. This prevents someone with physical access from quickly cycling through PIN prefixes and recording the corresponding words.
It is separate from the usual incorrect-PIN attempt limits. If you make a mistake within those first four characters, back out and begin the PIN entry again.