Youtube must produce URL by which the videos can be referenced. They prefer that the URL be short. They can choose the ID in any way that they see fit, provided that it matches their constraints, in particular:
- The ID must be unique (no two videos may share it).
- The ID must "work well" with whatever indexing mechanism they internally use.
Deriving the ID from the video "title" would be problematic in several ways: difficult to guarantee uniqueness, the usual Unicode-related mayhem when people have the insufferable arrogance of using characters which are not in the ASCII set, and string-based indexing (whereas I can imagine that a database would be happier with a 64-bit integer as indexing key).
There is a priori no security issue here. There would be a security issue if the URL were meant to reference non-public documents, in which case the ability to "guess" valid URL would be problematic (a possible solution would then be to include a MAC in the ID). But Youtube videos are inherently public (they make no sense otherwise -- already, a number of them make no sense at all anyway).