Exactly this. I had a contractor let himself into the building I was working in once. When questioned how, he said that it was obvious what the numbers where on the keypad due to the build up of grime. Needless to say they were cleaning thoroughly after that.
I have a colleague who is pretty good at this, we would often be working in a building out of hours and after being assured that Yes, all the doors are open for you (Fixed electrical testing - we need access to all places, except the smallest cupboards with no light in), we invaraibly find some small office or cleaning store secured with one of these, I've managed it a time or two but not reliably, athough I do remember some place that has an electronic keypad and maglocks (order does matter here) you could see which 4 buttons were pressed which would narrow it down to 24 codes, but two of them were keys were 1 and 9, pretty good shot that it would be year then, one combination would be about 90 years ago.... perhaps not that one, enter the other one... door open on first try
(No one asked how I got in though)
As to the original question, a key is either set or unset (as stated order doesn't matter and repeat digits are just the same as single ones*) so there are 13^2 = 8192 unique ways it could be set, so someone who knew this could have a 1 in 8192 of opening it each time they tried, however someone who didn't would have to go through a lot more combinations as codes in a different order, or containing repeating digits would map to the same one of the 8192 settings as another one
You could probably 'brute force' all the locking combinations in about 24 hours (and expect it on avaerage to take half that time to find the answer), however you can also 'brute force' it in 2 minutes with an oversized pair of pipe grips on the thumb turn and the internal locking pins bend and let it turn, it'll never work again though!
*If you set the code to 1111X, you could just press 1X to open it
