Traded in phone still shows up in Find My in repair mode

That is what happens when you remove a device using Find My on iCloud. It will remain in that state for 30 days, then removed from your account.

Remove a device from Find Devices on iCloud.com - Apple Support

The other way to remove the device and erase it is to do it right from the device and likely what the guy at the Apple Store was referring to by going back to the store. This will remove it immediately:

What to do before you sell, give away, or trade in your iPhone or iPad - Apple Support

No one will be able to get into your phone by attempting to "crack" you PIN with unlimited attempts. The erase command does not remove the Activation Lock though, and that will still happen according to the first Support Article. After the Activation Lock is removed, your data would be erased whether you did that remotely or not, since a reset would be required to remove your Passcode.

someone would just have unlimited time to try cracking my six digit pin.

That is not correct.

Unless you set up a very insecure code like 000000 or 123456, etc., there is no way that anyone could ever guess your correct passcode in less than 10 tries.

After 10 tries, the phone locks out and won't even allow even more tries.

This is normal and no one has access to your account information.

• Remove a device from Find Devices on iCloud.com
• Activation Lock security
• Prepare your iPhone for service