If they're not able to pick the lock, hackers can just try to kick the door down.
That's done by running an automatic scanning program that enters every possible combination in an attempt to find the right code that unlocks the system.
This so-called "brute force" method is perhaps best explained by Verizon:
"These scans run at all hours of the day and night, trying to gain access, and recording successes. The would-be assailant wakes up, has some coffee (or tea, or maybe even vodka), and begins the workday with a nice compiled list of IPs for vulnerable devices along with the exact usernames and passwords needed to access them. After that, put in a few hours cramming malware onto selected systems, revisit last week's victims to collect some captured data, and then head home early to the wife and kids."
Large, organized crime syndicates have been launching sophisticated attacks for decades.
