Is it necessary to use cryptographically-secure randomness in order to create URLs for user activation?

Question

Usually once you register in a website you need to visit a url like:

https://example.com/user_activate/^random_string^

Does the ^random_string^ necessarily need to be cryptographically pseudorandom instead of a time-based random one?

I mean is a necessity to use cryptographically secure randomness such as openssl_random_pseudo_bytes or a time based one such as:

$string = array_shuffle(explode('','ABCDEFGHIJKLMNOPQRSTUVWXYZ'));

The most common example using the openssl_random_pseudo_bytes is:

$length = 10;//Some size.
$token = bin2hex(openssl_random_pseudo_bytes($length));

Answer 1

As long as the bad randomness could be exploited in any meaningful way by any attacker, you should use a cryptographically secure source.

This is obviously true for user activation tokens, since it could allow an attacker to bypass other security measures (like email verification).