It seems like in some cases, you do need to know how os.urandom() generates random numbers. On Linux, using getrandom() to read /dev/urandom in blocking mode or reading from /dev/urandom give a different level of security if the urandom entropy pool is not feeded with enough entropy yet. See the issue #26839 for the background.