Unusual? Yes. Crazy? No. Read on to understand why...

I expect your bank has a strong lockout policy, for example, three incorrect login attempts locks the account for 24 hours. If that is the case, a 6-digit PIN is not as vulnerable as you might think. An attacker that tried three PINs every day for a whole year, would still only have about a 0.1% chance of guessing the PIN.

Most websites (Facebook, Gmail, etc.) use either email addresses or user-selected names as the user name, and these are readily guessable by attackers. Such sites tend to have a much more relaxed lockout policy, for example, three incorrect logins locks for account for 60 seconds. If they had a stronger lockout policy, hackers could cause all sorts of trouble by locking legitimate people out of their accounts. The need to keep accounts secure with a relaxed lockout policy is why they insist on strong passwords.

In the case of your bank, the user name is a 16-digit number - your card number. You do generally keep your card number private. Sure, you use it for card transactions (online and offline) and it is in your wallet in plaintext - but it is reasonably private. This allows the bank to have a stronger lockout policy without exposing users to denial of service attacks.

In practical terms, this arrangement is secure. If your house mate finds your card, they can't access your account because they don't know the PIN. If some hacker tries to bulk hack thousands of accounts, they can't because they don't know the card numbers. Most account compromises occur because of phishing or malware, and a 6-digit PIN is no more vulnerable to those attacks than a very long and complex password. I suspect that your bank has no more day-to-day security problems than other banks that use normal passwords.

You mention that transactions need multi-factor authentication. So the main risk of a compromised PIN is that someone could view your private banking details. They could see your salary, and your history of dodgy purchases. A few people have mentioned that a 6-digit PIN is trivially vulnerable to an offline brute force attack. So if someone stole the database, they could crack your hash, and get your PIN. While that is true, it doesn't greatly matter. If they cracked your PIN they could login and see your banking history - but not make transactions. But in that scenario they can see your banking history anyway - they've already stolen the database!

So while this arrangement is not typical, it appears that it is not so crazy after all. One benefit it may have is that people won't reuse the same password on other sites. I suspect they have done this for usability reasons - people complained that they couldn't remember the long, complex passwords that the site previously required.

In your example, we can think about it as follows:

A six-digit code has 1,000,000 possible states, hence allows for a 1/1,000,000 chance to correctly guess it on the first try. Given that we can try thrice, the second chance is 1 / 999,999 and the third is 1 / 999,998. Although, the numbers are too close to 3/1,000,000 for it to make statistical difference.

So we can say, for one generated code, our chance is 3/1,000,000. That means, plugging into the formula 1-(1-p)^n = x, we get an n of ≈231,049 codes to generate for a 50% chance of cracking it.

In other words: If 231,049 different hackers each tried to hack a six-digit code by choosing 3 random codes, then about half of them would succeed.

Since we can do this 10 times an hour, we can conveniently just divide this by 10 to see how many hours it'd take, which is 23,105 hours, or about 2.6 years.

This is actually slightly better than your estimate.

Why does it not align with the linked calculation?

This is because you're not sufficiently exhausting the keyspace. As I said in the beginning, the second and third guess are slightly more likely to succeed than the first one, because you already know one code that isn't correct, and later two.

However, on your third wrong guess, the code becomes invalid and you are back at the beginning. For this reason, you have to use a different formula, which calculates the cumulative chance of independent events, rather than simply checking how large the keyspace is and dividing it in half.

Regarding the real world

In real life, it's likely even more difficult to be successful, because repeatedly entering wrong one-time codes could lock the account, or the service could notify the user that their account is likely compromised, which leads to them changing their password.

In short, OTP codes like this are not bullet-proof and can be guessed by sheer luck, but it's very unlikely to lead to consistent success.

Increasing Security

This scheme is already plenty secure - secure enough that PayPal uses it - but if you want to go even further, you could make the codes longer. 8 digits would turn 2.6 years to 260 years (roughly), and adding even some uppercase letters to it would make the keyspace even larger.

The downside would be a worse user experience, as "632 109" is slightly easier to type than "P88X 6A3H". It would risk users not enabling 2FA at all, all for making a theoretical attack theoretically more difficult.