This is highly amusing. As the developer on the official AOSP ticket for this said, Java apps get their random bits from RandomBitsSupplier, which, quite clearly, does not read from /dev/urandom, as evidenced by line 72 in https://android.googlesource.com/platform/libcore/+/master/l...:

  private static final String DEVICE_NAMES[] = { "/dev/urandom" /*, "/dev/random" */ };