> A random number in the range 000-999 is more secure than 001-998, rejecting values weakens it.

This sort of argument gets misused a lot. If your entire list of exclusions is less than 5% of the keyspace, you have not meaningfully weakened security. The ability to detect when a number has been left at its default value is far more useful.

It's probably not worth excluding real customers to get that "is the number default?" check. But as a critique on the design of CVV, the system would be better if it never assigned 000.