Encryption Key derivation from numeric PIN?
It is common that the attacker has at least as fast platform as somebody generating the key. Thus, brute force attacker can test all 4 digit PINs in 1000 seconds or 17 minutes (based on 100 ms seconds mentioned in the question).

BTW, it is fairly common to use larger iteration counts than minimum of 1000 and longer times (like anything that takes 1s to process. On modern platforms, counts of 10000 or 100000 can be completely reasonable). In addition, it is common to punish wrong attempts with delay to slow down guessing.

In case the attacker has access to some computing power, like ASIC circuitry designed for cracking PBKDF2, they may be able to break the secret, for instance, 1000 times faster i.e, the could guess 10000 pins/passwords per second (assuming key derivation takes 100 ms seconds on the device).

--

For PIN and PBKDF2 to be secure against attacks, it is often mandatory to do these:


Attacker cannot get direct access to the storage on the device (to get values needed for breaking the secret offline with specialized devices)
The device does not allow to try many PINs very quickly (increasing delay after trying).
Too many miss attempts lock the device.


But, generally using good passwords is much more secure than using PIN codes.
This is my earlier answer on security of PIN or password when materials needed for brute forcing are available for the attacker.