Let's dive into JS generating seed phrase.

First, I could myself generate a seed phrase without anything. I just pick 24 words from the list given in the BIP 39 protocol.
So if Ian colman give me a list of 24 words randomly in the same list what can be wrong? It is just picking word at random.

The risk maybe is the code being change to give me a list of 24 word already known by somebody. But this is hacking not JS related.