Your device PIN protects against someone picking up the physical device and using it without your knowledge — enough failed attempts wipes the device.
A passphrase, sometimes called a 25th word, is a separate layer: it’s an additional word or phrase you choose that, combined with your recovery phrase, derives a completely different wallet. Without the passphrase, someone with your recovery phrase alone reaches an empty decoy wallet.
A passphrase adds real protection, but it also means there’s no way to recover funds if you forget it — treat it with the same care as the recovery phrase itself.