It can happen in theory. `read` is allowed to return 0 bytes and POSIX doesn't make guarantees about how many bytes a single read to /dev/urandom will return.

I think the worst case from 0 byte reads here without that check is an infinite loop because `size` will never decrease. Seems safer to just give up producing numbers if things get that weird.