What security advantage is gained when a bank mails your credit card separately from the letter containing your PIN—couldn’t a thief just steal both anyway?

The probability of a thief having access to both drops, when you separate the mail. It was an old age practice which now really isn't necessary as almost all cards delivered are non active, and require a call-in to activate the cards.

However, some issuing banks feel that the knowledge required to activate a card can be still be compromised (assuming the thief has access to the card+PIN), so best to send the PIN and Card separately to further reduce the probability.