I wonder how much a random username really adds to the security. Sounds a bit paranoid to me. Esp. if passwords are already disabled.
I doubt it helps by much, but I see it as also helpful downstream for other kinds of fuzzing/defense against future bad practices. You can't script as easily against a randomized username as you can against e.g. `admin`.