Ask HN: Best Password Reset Practices?

I am wondering why people recommend sending a token based url to a reset password form rather than just create a new random password and send that by email in plain text.

The main objection is that the random password is sent unencrypted, but that doesn't really matter as the token based url is also just as accessible using the email. If someone has access to the email account, it doesn't really matter whether there resides a token based url or a plain text password, both can be accessed.

Having expiration goes for both of course.

Why is token based better than sending a plain text new password with an expiration, forcing the user to create a new password? Best practices and why?