There's technically no distinction between a random url, and a random prime that is part of a keypair. There's a difference of "degree" of randomness, but not of approach.

In both cases you get owned if somebody guesses your random bytestring.