Most member who visit this board aren't programmer or Bitcoin developer, so don't expect hardcore feedback. But here's my amateur feedback.
1. What would happen if there's no audio input on the device? Would the code throw error or return weird data?
2. Consider adding tests to your code.
3. I think using audio input, os.urandom and secrets should be secure enough.