Maybe they don’t know how to expire the codes so they just made them longer and are hoping. Or maybe they don’t know how to throttle attempts so they just said “surely no one can guess 10 digits in this 10 minute window”