Why is Math.floor(Math.random()*9000) not secure in JavaScript?
According to this answer, math.random uses a Linear Congruential Generator (although it is not clear to me if that's on one specific browser, or on all JavaScript implementations).

In any case, a Linear Congruential Generator is known not to be secure, in the sense that, given partial output (which the Math.floor( 9000 * Math.random() ) operation allows), someone is able to reconstruct the initial seed, and from that, reconstruct the entire sequence.

In particular, if the browser uses the popular XORSHIFT128+ RNG, and you are able to deduce 128 lsbits from the underlying 32 bit outputs, you can reconstruct the initial state (by solving some binary linear equations).