Exactly. Knowing the 12 words but not the order implies only ~29 bits of entropy between an attacker and your key.