A recovery phrase is an encoding of a random number, so its strength is inherited entirely from the quality of the randomness that produced it. That is why generation happens on the air-gapped side in BootVault, with key derivation at PBKDF2 500,000 iterations. Offline generation removes an entire class of attack where the generating environment is what leaks.