Exactly. Knowing the 12 words but not the order implies only ~29 bits of entropy between an attacker and your key.
How would an attacker ever gain access to the words but not the order?
Some people write down their seed altering the order in a known way (by them) so that they can recover the seed easily but, in case someone gets access to the list, they would not be able... at least so easily.
Even some people here (not gonna give names) mentioned doing so.
It is now clear it is probably not the best of ideas anymore...