I think it’s a good question! For me personally I feel that urandom is the right thing to do. Perhaps I’m overly cautious but I don’t think it’s prudent to include an external dependency when there is a good local alternative included in most systems. urandom is very solid. If one’s network connection goes down or random.org goes down, one can still generate randomness without problems.