Wow, it's by design:

" os.urandom(n)

    Return a string of n random bytes suitable for cryptographic use."


``man urandom'':

"A read from the /dev/urandom device will not block waiting for more entropy.  As a result,  if  there  is
       not sufficient entropy in the entropy pool, the returned values are theoretically vulnerable to a crypto-
       graphic attack on the algorithms used by the driver."