On the one hand, a serial base id like https://example.com/user/items/55 https://example.com/user/items/55, seems less secure than a UUID based approach as if a

On the one hand, a serial base id like https://example.com/user/items/55 https://example.com/user/items/55, seems less secure than a UUID based approach as if all else fails the UUID is still hard to guess. On the other, some systems (github private repos for example), don't seem to worry about how easily a URL can be guessed. Is it perhaps the case that probability of successful attack is not materially reduced in with a hard to guess url in the final analysis?