They need to be unique and unguessable, which don't necessarily go together.

For example, a version 1 UUID is unique, but is fairly guessable, since it's just a MAC address, a timestamp, and a small random-initialized counter.