In brief
uuid.uuid4() creates a random UUID that can distinguish records without a central sequential counter. It does not establish who may open the corresponding record.
Useful to know
uuid.uuid4() creates a random UUID that can distinguish records without a central sequential counter. It does not establish who may open the corresponding record. [1]
A document URL still needs user and permission checks. An identifier that is difficult to guess cannot replace authorization. The UUID version matters too: different versions do not all use the same generation method.
Sources
For further detail and to check the information: