Based on the documentation of random.SysRandom I think it comes down to #1. Perhaps the secrets documentation simply shouldn't mention the random module beyond how it's different? Then any use of the random module by the secrets module is an implementation detail that people can never rely on because we never said anything in the docs about it and clearly say "we do whatever is necessary to get you the most random bytes possible, backwards-compat be damned in how we pull it off".