Although a 12-word phrase provides 128 bits of entropy while a 24-word phrase provides 256 bits, in practice it makes no difference.
Nobody is brute forcing / guessing your seed words. Nobody. It would make no sense and be a complete waste of resources (unless they already had a partial list). Generating a seed from a mnemonic is computational expensive (it requires 2048 operations of HMAC-SHA512).
If someone really did want to try stealing bitcoin in this way, they’d instead target a private key directly, which still only (!) requires 2^128 operations with current tech, so it makes no practical difference.
Bitcoin uses the secp256k1 elliptic curve, a 256-bit curve. The best known attack, Pollard’s rho algorithm, takes a number of operations equal to about half the curve size. This means that an attacker attempting to find the private key for a given Bitcoin address would need to perform 2^128 operations in order to guess the private key correctly.
