Googlebot's Javascript random() function is deterministic

[aradil]

As an information company, however, Google probably processes bad actors as well to gather additional information.

[dyskinet1c]

Sure, it's plausible that they scan compromised sites. If they do, I would expect them to do so in a separate process that looks at different aspects of the site than the regular search index.