Probably more lacking automated test coverage than bad luck? For security critical RNG code, seems to me you’d really want to have a test where it generates a tonne of random numbers and asserts that they’re all unique.
Obligatory Dilbert https://imgur.com/uR4WuQ0 and XKCD: https://xkcd.com/221/