Attack vector difference when not allowing repetitions in BIP-39
There is no impact on security.

The seed combinations can have more entropy than the 128-bit key you feed into it. Assuming the function you use to convert the 128-bit key into the 12-word seed is injective, then you won't even be able to reach all possible seeds with the keyspace you have, since $2048^{12} \gg 2^{128}$.

The entropy in 12 random words picked from a set of 2048 is $\log_2(2048^{12}) = 132$ bits. If you only allow unique words, it is $\log_2(\frac{2048!}{(2048-12)!}) \approx 131.95$ bits. These are greater than 128.