UUID v4 seems to be based on random numbers, so should be "as good" as whatever scheme they were trying to hand roll here. Additionally, the uuid npm library uses crypto.randomBytes, which is cryptographically secure.
If you go and look at node-uuid commit history it, too, used Math.random() back in the day.