What length PIN would you recommend in light of what commercially-available equipment is capable of cracking? Is an actual, honest-to-god password supported on latest Android?
It really depends on how your password is selected. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" is a long password but won't protect you. You really want to optimize for ease of entry and memory, rather than using the largest character set or having the longest password. For a point of reference, these three choices have (roughly) equivalent security (128 bits of entropy):
1. 27 characters - all lowercase, randomly selected
2. 20 characters - upper/lower case + 15 special characters found on the first page of the iOS keyboard, randomly selected
3. 45 characters - 10 words from eff's short diceware wordlist, randomly selected
the first option would be the easiest to enter, despite being 7 characters longer than the second one, because you don't have to constantly switch between the various character types (since you're using a touch keyboard). The third one is 66% longer than the first one, but probably is easier to remember.
As for how many bits of entropy to use, AFAIK a preimage attack against md5 (128 bits) hasn't been pulled off yet, so it's probably safe for for the foreseeable future. You can probably go lower than that and still be safe, considering that a md5 preimage attack is significantly easier than cracking a phone pin (eg. no memory/cpu hard KDF, no trustzone/secure enclave).
> honest-to-god password supported on latest Android?
Yep, I have one. I haven't kept up with the latest, but the "standard" good password should be good (i.e. above 12 characters, letteers, numbers, etc.)?
