In Crypto, your accounts are only as safe as your secret keys are secret and unguessable. For that reason, it's healthy to ask: Where are my MetaMask keys coming from? In fact, the most security-conscious individuals have been known to generate their own keys with a set of dice!
For a browser-based piece of software like MetaMask, there is no source of randomness (or entropy) that is more secure than the browser's native Crypto.getRandomValues function, which itself seeds itself with your operating system's entropy source, making this the best source of random numbers that a browser-based application can provide without your help.
Someday MetaMask may add more advanced features, to allow you to help generate your own random numbers, for example by wiggling your mouse, flipping coins, babbling into the microphone, or something, but for now, we're providing the simplest solution possible, to make adoption a little bit easier.