As long as a truly randomly generated password is at least 6 characters long, it passes the NIST's password standards, which is regarded by many to be a good bare minimum standard. (A user-generated password should be at least 8 characters long, because it's much less likely to be randomly generated.) Your own security team should decide on reasonable minimums for your organization.
The most important factor in any secure password is how random it is. If we assume that the passwords are generated in a secure way, then varying their length will tend to improve the security of the overall system.
Applying Kerckhoff's Principle, that everything in a system is public knowledge except for the key -- in our case, except for your password -- we must assume that an attacker will know the length of the passwords that such a system generates. If they can't be certain of the length because it can be anywhere from 10 to 95 characters, then this increases the search space, and can increase the time it takes to brute force a password (though if you're unlucky enough to get a very short password, it might decrease the time).
So, outside of any other considerations, the security of a system is not meaningfully impacted by having a random password length, when that password has a reasonably long minimum length.
You state in your comments that the emails are always sent encrypted. This removes one such "other consideration" that I allude to in the above paragraph. If they were sent unencrypted, then the proper action would to make these randomly generated password be one-time-use passwords which must be reset once you gain access to the account. This way, if someone did beat you to logging in, you would know, and could take additional action as necessary.
Another consideration is password storage. Since you have access to the application's source code, you can ensure that they're using a key stretching algorithm with configurable difficulties to make offline brute force attacks as expensive as possible. The NIST standard specifically mentions PBKDF2 and BALLOON. Other key stretching algorithms with configurable difficulties include bcrypt, scrypt, and Argon2. Simply salting and hashing a password is no longer considered secure, even if using the "best" cryptographic hashing algorithm. These hashing algorithms are indeed part of PBKDF2, but should not be used by themselves to secure passwords.
One final consideration is the human factor. People don't enjoy using very long, truly random passwords. The longer and less memorable it is, the more likely it is to appear on sticky notes tucked under keyboards. The solution to this, of course, is to encourage use of password managers.