Creating a system account used by a module: Is setting the password with drupal_random_bytes() too excessive, or is there a better method?
As you probably know, another option is to use user_password() to get the password string.

When Drupal hashes it, e.g during user_save(), with user_hash_password(), drupal_random_bytes() is used as part of the _password_generate_salt() calculation.

Just thought it worth mentioning.

You may also be interested in preventing login through the UI by that account with a user_login validation handler.