Ironically, they probably even did that (depending on their implementation of std::random_device).

The problem is what they did with that random seed once they had retrieved it (i.e. seed a non-cryptographic Mersenne Twister with only 32 bits of it).