if a hacker found a valid 12 or 24 word seed phrase I'm not sure that they even can know that its got a passphrase which is some protection. I guess having funds in the 12 words without the passphrase would tell them that it might have a passphrase with other funds and they would start hacking it. With a long passphrase its probably quite safe but I'd be moving the funds as quickly as possible if it were me.