12 words is enough. And should be a default.

More words adds to key generation entropy, but doesn't make your private key more secure. On the other hand it makes it much harder to store/backup (and enter) it.

Bruteforce attack on 12 word seed phrase is ifeasible (would require billions of years to guess with the most modern computers) and you don't know if it holds any bitcoin! Isn't it better to use that power to mine bitcoin instead?

So much better way for an attacker is to actually try to get to private key directly from a known address with bitcoin and public key (solving ECDLP).

Which similarily infeasible as guessing random seed ohrases, but at least you know that it actually allows you to access some bitcion.