Seed Phrase Security

Each word in a BIP-39 seed phrase stands for how much information?

• 4 bits, one per letter that identifies it
• 11 bits, because the list has 2,048 words
• 128 bits, the same as the whole phrase

A friend says, "I keep my seed phrase in a notes app, but my phone has a passcode, so it's fine." What's the flaw?

• None; a passcode protects the notes
• Notes can sync to cloud accounts and backups, so the phrase sits on devices and servers beyond the phone
• Notes apps can't store 12 words