If there needs to be an auth check for other IDs, then it shouldn't matter whether the IDs are random or not. Depending on how highly aesthetic URLs are valued

If there needs to be an auth check for other IDs, then it shouldn't matter whether the IDs are random or not. Depending on how highly aesthetic URLs are valued, it's not unlikely that after being in business for a while, the density of your keyspace will mean that even random IDs are found. A better rationale for disconnecting public and private IDs is to make certain types of database migration a little bit easier. I don't think it's a huge win though, it's a chunk of work to maintain multiple IDs, do the required inderictions all the time, ensure public IDs are always sent to front end, and so on, while adding a translation layer as part of a database migration delays this kind of work until it's actually needed, if ever.