I suspect they want a "good" random generator, and a cryptographically secure generator is a known good generator. Without one you don't have a definition of ra

I suspect they want a "good" random generator, and a cryptographically secure generator is a known good generator. Without one you don't have a definition of random and you may end up with an unacceptably high chance of collisions.