Technically you can't be sure that when you open() /dev/random in a native C application that it's actually opening /dev/random either. Yes, really.
If that native C application runs on a server that is fully under your control you stand a far, far better chance then when that native C application (say a web browser) runs on some computer not under your control. Especially if that native C application is explicitly written to accept run-time addition of random third-party code (aka browser extensions).