Feige–Fiat–Shamir identification scheme: Question about a part of the ZK protocol
If $b$ was always the same value, you could convince the Verifier that you have the private key even though you actually don't!

Case $b = 1$:

Instead of sending $x = {\text{randNum}}^2 \bmod n$, the false Prover can send $x = {\text{randNum}}^2 / \text{pubKey} \bmod n$.

Assuming the Verifier sends $b = 1$, the false Prover can then send $\text{randNum} \bmod n$.

When the Verifier verifies the response, they check if ${\text{randNum}}^2 == (({\text{randNum}}^2)/\text{pubKey} \bmod n) \times \text{pubKey} \bmod n)$, which simplifies to ${\text{randNum}}^2 == {\text{randNum}}^2 \bmod n$, and that's obviously true. So even though the false Prover doesn't actually have the private key, the verification succeeded. But here's the catch: If $b$ turns out to be $0$ instead, they'd have to send $\sqrt{x} \bmod n$ in the final step. This is computationally infeasible.

As you observed, if the false Prover sends $x = {\text{randNum}}^2$ and $b$ turns out to be $0$, they can pass the verification. But if $b = 1$, the false Prover can't pass the final step, as they don't know $\text{privKey}$.

In summary, the false Prover has to commit to $b$ either being $0$ or $1$ before sending $x$. Each guess has a 50/50 probability of being correct. So after $t$ rounds, the chance of the Prover actually being a false Prover is $(1/2)^t$