That's why they're called pseudo-random numbers
However calling the function twice (as the script does now) doesn't improve the "randomness".
As long as the function roughly follows the expected distribution it doesn't really matter in this case though, as we're not building a crypto application where true randomness is essential, but just a "random failure" feature where inspiring the feeling of randomness in a human observer is sufficient.
Edit: IIRC rand() in php is/was notoriously bad, which is why mt_rand() was introduced and made an alias for rand in php 7.1.
Also Windows actually offers CryptGenRandom if you need a fairly good random generator, which would be overkill in this case though.