Regardless of whether you have a passphrase or not 12 words is just as secure as 24 words because the resulting public key will still require 2^128 iterations to compute its private key using the most efficient algorithm. That is relevant because the most efficient algorithm to crack secp256k1 keys "Pollard's rho algorithm" does not try to guess your password or seed words but instead tries to reverse a public key to its private key. It should probably be noted that properly generated Bitcoin keys cant be cracked efficiently with modern hardware even with Pollards rho, improperly generated or purposefully weaker keys may be cracked So no it is not recommended to use 24 words it is completely optional, it may theoretically help against attacks in which someone guesses / brute-forces your seed phrase (assuming your seed phrase was generated in a securely random fashion) but brute-force is still highly inefficient compared to Pollard's rho algorithm. This is more or less covered here: 12 or 24 words for mnemonic?.
In fact, cryptographically speaking, there is no benefit to private keys having more than 128 bits of entropy, as long as there is no pattern in them (e.g. don't use just 128 bit numbers as private keys, that's broken, but using the hash of 128 bit numbers appears to be just fine). The reason for suggesting more is just defense in depth. – Pieter Wuille Feb 25 at 6:00
24 words = 256 bits, 12 words = 128 bits. But finding a private key given the public key already costs only 2^128 operations (using e.g. Pollard's rho algorithm, not using brute force of course). So if an attacker can just attack the private key keys that come out directly, there is no reason to try to find the seed. – Pieter Wuille Feb 25 at 19:28