Apparently, ECC 256 bit keys have a bit strength of 128 bits. See https://crypto.stackexchange.com/questions/26791/how-many-bits-of-entropy-does-an-elliptic-curve-key-of-length-n-provide
And apparently, no one needs more than 128 bits of entropy https://security.stackexchange.com/questions/102157/do-you-need-more-then-128bit-entropy
So if I'm correct in saying that it's pointless for the private spend key to be derived from a seed with more than 128 bits of entropy, and given that it is currently the case that the private view key is derived from a hash of the private spend key, why does Monero use a 256 bit seed?
Perhaps the 'multi-target attack' mentioned here is relevant? https://crypto.stackexchange.com/questions/39991/can-i-use-128-bits-of-entropy-and-a-kdf-to-make-a-256-bit-ecc-key
Update: Multi-target attacks do not appear to be an issue. See https://crypto.stackexchange.com/questions/56541/is-it-safe-to-generate-two-256-bit-ecc-keys-from-128-bits-of-entropy
Update 2: It looks like BIP32 actually recommends that 256 bits of entropy are used to generate a Bitcoin wallet. See https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#Master_key_generation
This means that the 13 word, 128 bit seeds used in many Bitcoin wallets actually go against the recommendation in BIP32.
Therefore Monero is actually following the recommendations of BIP32 by using 256 bits of entropy via a 25 word seed.
Perhaps the real question should therefore be: Why do Bitcoin HD wallets use only 128 bit seeds, and ignore the BIP32 recommendation? I've asked that question here: https://bitcoin.stackexchange.com/questions/72612/bip32-recommends-a-256-bit-seed-why-do-most-bitcoin-wallets-only-use-a-128-bit