If a PRNG has a long enough sequence of numbers, why can it be bruteforced?

I read that the seed needs to be unpredictable in a pseudo-random generation, because if they could narrow down the possible seed to a reasonable amount of different values, a brute-force attack would be possible.

This confuses me however. Imagine if I use an algorithm that generates pseudo-random numbers. In theory they will cycle at some point, but in practice this apparently seldom happens according to many people. If that's the case, let's say an attacker has narrowed the seed down to 50k different seeds (the attacker knows that the seed is one of these 50k seeds). And the attacker also has a login cookie based on this random generator (the attacker knows the algorithm which makes the login cookies).

If the attacker then checks every seed value of these 50k possible seeds and compares the result to his own login cookie in order to pinpoint the seed used... What guarantees are there that the login cookie generated by the attacker uses the same values from the pseudo-random sequence as the login cookie? What if the pseudo random generator uses the "last" numbers in the sequence before the cycle on this particular login cookie. Wouldn't this force the attacker to iterate billions of times (or more) for each seed to try since the attacker needs to try every possible value the PRNG can generate?

A pseudo-random sequence of numbers is after all random, as long as it's infinite or close to infinite without a cycle.

Hope I could make my question clear enough.