- Edited
Nuttso 128-bit entropy is the standard value for extreme overkill that's secure far into the future. It doesn't really make sense to generate a random passphrase with more than 128-bit entropy. The amount of entropy is a different thing from the size of the derived key encryption key. The useful reason for security levels above 128-bit is because algorithms get broken in ways that substantially reduce their security. 256-bit cipher which experiences a quite extreme break can still end up providing more than 128-bit security, thus still preserving indefinitely overkill security in practice. This is why using AES256 instead of AES128 makes sense, but generating a 256-bit entropy passphrase / seed phrase which just gets fed into a key derivation algorithm to derive arbitrary length keys really doesn't make sense.
Significantly lower than 128-bit security is still considered secure and is just below the standard for extreme overkill that most people have settled on as making sense. Since passphrases go through key derivation adding a substantial work factor, passphrases with 90-bit entropy such as 7 diceword words or 18 lowercase letters/numbers are still highly secure and don't depend on hardware security features to prevent brute forcing. If you really want, you can raise that to 128-bit for extreme overkill but it is substantially more inconvenient and not really giving you real world benefits.
On the other hand, something like a 64-bit entropy passphrase is not secure against brute forcing if the attacker can bypass the hardware security features. Passphrases below around 90-bit entropy can still be secure if the secure element is compromised but if both the secure element and hardware bound key derivation are bypassed, there's a serious problem.
If the secure element isn't compromised, a random 6 digit PIN is secure against brute forcing. This is the kind of scenario in the original post where they exploit the OS and then need to exploit the secure element to bypass the brute forcing, leaving them needing a rare/sophisticated kind of exploit for the secure element firmware.
