If you want to do something as trivial as an unbiased Fisher-Yates shuffle of an array, however, Math.random() is broken. And Math.random() doesn't have to be broken for things like UUIDs. Python and Ruby both have PRNGs that are suitable for such things.

We fucked up by not vetting the algorithm, that's definitely the primary lesson here. Mea culpa. I'm sure you would have done things differently, but V8 is a modern system and I don't think assuming a modern PRNG was completely unreasonable while quickly getting to MVP at a new startup.