1) domain.com/login user: John password: 5 char random password
2) domain.com/12 char random url
If we assume both either have the same bruteforce/rate limiting protection (or none at all). Why is 1 more safe than 2?
In practice, there is.
There is a difference between something-you-have secrets and something-you-know secrets.
A UrL is something you have. It can be taken from you if you leave it somewhere accessible. Passwords are something-you-know and if managed well can not be taken (except for the lead pipe attack).
There is also something-you-are, which includes retina and fingerprint scans.
(1) Requires some out-of-band information to authenticate. Information that people are used to keeping safe.
On the other hand the URLs in (2) are handled as URLs. URLs are often logged, recorded, shared, passed around. E.g. your work firewall logging the username and password you used to log into a service would obviously be bad, but logging URLs you've accessed would probably seems fine.
[the latter case is just an example - the E2E guarantees of TLS mean that neither should be accessible]
1. "Password" is a magic word that makes people less likely to just paste it into anything.
2. Username + passwords are two separate pieces of information that are not normally copy-pasted at the same time or have a canonical way of being stored next to each other.
I think the arguments other commenters have made about logging, browser history storage, etc are more convincing
One of the major issues is that many logging applications will log the full url somewhere, so now your logging 'passwords'.
eg Your web browser will automatically save any URLs to it's history for any user of the computer to see but will ask first before saving passwords.
eg Any web proxies your traffic goes through or other software that's looking like virus scanners will probably log URLs but probably won't log form contents (yes HTTPS makes this one more complicated but still).