I received an email today letting me know that the 4-digit PINs are on their way out. At some unspecified, but soonish date, everyone will be required to create a more secure password. The email was to let me know that I didn't need to wait and that I could make the change now.
Please note that your four-digit PIN will expire soon. If you decide not to update your password now, you will be required to create a password when signing into your IHG One Rewards account once your PIN expires.
Obviously, this is all to the good. But very late in coming. The company I work for now requires all of our website customers to use two-factor authentication. Previously, that was optional, but encouraged, with us. In the 18 years that I have been working for them. I don't believe that a password as simple as four digits was ever permitted.