#They secure things well because they are not the only barrier
There are essentially three different types of factors in authentication:
- Something you know (eg. password)
- Something you have (eg. key)
- Something you are (eg. fingerprint)
Two factors are inherently stronger than one, and even if an individual factor may be weak on it's own, combining it with others can still be sufficiently strong.
In Star Trek, one factor that seems almost ubiquitous across the board is voice authentication (something you are). We see it used in every instance of self-destruct sequence initiation shown here:
So at the very least, you're going to need a voice match. I imagine there's alternatives to this in the event a person is unable to speak (while we've not seen it used before to my knowledge, it would likely require other forms of verification in its place).
Besides voice, there are three other apparent types of verification we see as well (of which at least one is always in use):
- Security code
- Hand print verification
- Additional user verification (more people verifying)
In addition to the above, we know location can also play a factor, as seen in the following video (Data locks command access to the bridge):
And lastly, while we know that combadges can track location of their owners to the ship (which on its own could help confirm a voice match). But per the following, they can also communicate identity to starfleet computers for logging purposes (acting at a "key" of sorts):
Starfleet combadges silently provided identification to starship computers. For example, when a person wearing a combadge accessed a certain console, the computer logged the individual's identification to that access. (TNG: "The Drumhead")
Combining all of the above, including implied measures like location tracking and combadge authentication, and it appears that we actually have pretty comprehensive security coverage. At this point, we can stop looking at the command code as the main barrier, and start looking at it as a small part to the whole, more akin to a pin code, to help avoid certain specific attack vectors.
Of all the other factors above, it is the only one that requires something you know. So if someone were to take over your body, clone you, etc, they would still be lacking in full control over the ship.
While the code may seem short in combating the above, consider that the ship itself may not be so forgiving to multiple wrong guesses. Likewise, a longer code is harder to memorize than a small 3-4 character code that changes periodically, and officers would be less likely to change it frequently. Longer codes are possible to designate as we see Data do in the second video, but at that point he's combating all the captain's other authentication abilities to override and potentially break Data's own elevated access.
All this to say, none of those factors on their own are sufficient to protect a starship. but together they are fairly robust against multiple vectors, and far beyond the level most present day security systems.