Python's random module is the wrong tool for passwords, and swapping it for secrets is only most of the fix. The shuffle at the end catches people out.
