I understand that seed phrase can easily be guessed by a hacker but then he needs to be able to crack the 18 characters (combination of lower, upper case, number, special characters such as * ? >< !@#}|_-&^%$)
You are underestimating lots of hackers.
There are so much ways for a hacker to infiltrate your device and steal your password. The three seed phrase can be easily guessed and so does the password. It will maybe take quite a long time but I don’t see any reason why it could be impossible.