Is it possible to generate a 6-digit number using 256-bit encryption?
I believe the claim of using "256-bit encryption" is primarily being done for marketing purposes.

Despite the best efforts of industry experts there are many people with a limited understanding of cryptography, and they associate "bigger key sizes" with "better security."  (While this is generally true, it's a very narrow view that excludes many important security factors; besides, key size differences become almost trivial beyond a certain threshold.)  Sadly, that's a surprisingly large number of people.  

Marketers know the money coming from people who don't understand the details spends just as well as money from people who do.

So what can you do about it, or what should you do about it?  Perform a security analysis reviewing what the product is capable of, given the facts you have.  Is six digits enough to stop people from guessing in the time limit given them?  Do they have a three-tries-then-lockout mechanism?  What is the value to you of the system they're protecting?  What is your risk exposure should it be violated?  Are there other access controls in place, and should there be?