The purpose of Blockstream Jade's blind oracle is to not have the encryption key stored in Jade, preventing physical key extraction. It serves as a secure element in an external server to maintain full open-source integrity.
The secret key to unlock the wallet is obtained through an Elliptic Curve Diffie-Hellman (ECDH) key exchange, which requires correctly setting the PIN.
The security of the PIN itself is a valid concern, as it is not stored in a secure element.
If an attacker gains access to the PIN, they could potentially perform the ECDH themselves and obtain the secret key, undermining the overall security.