UUIDs are a valid security tool

why would you use a UUID for this? A version 4 UUID does have about 122 random bits, so it could work OK for this use case. But firstly, it's unnecessarily short. And secondly, why? FFS, WHY?

Why not just use a random number with the length of your choosing, encoded in hex, base-64, or whatever floats your boat?