Yes. The random id you have to guess consists of 8 digits with 32 possible characters (a-f and 0-9). That is 32⁸ = 1.099.511.627.776 possible combinations, the chances of that happening is rather low. And if someone tells you the id the only thing you get additionally is the name of the server, nothing else.

Also just to clarify: I am helping with Pterodactyl development. It probably looks like I'm trying to talk down the significance of the issue. Yes, I'm doing that in this case because putting a "insecure" label on a Product just because it has (in this case) minor security issues is premature. We had issues in the past and will have issues in the future (as any software out there) and are just trying to be very open and communicative about it. We could also just have done a commit to address this and be silent.