How a TPM is protected against a brute forcing its PIN?

A one thing I don't understand about the TPM's workings is how the hell it's possible that it can securely store a key while being protected by just a few digit PIN, that in the normal situation could be brute forced in seconds. It has some lockdown mechanism, but if someone have physical access to the device, why can't he just take the TPM apart and extract the encrypted key from it and then just brute force it?

brute forcing pin privacy tpm