The email verification link is as secure as your email security and is single-use besides. The idea behind providing the password for you is to avoid someone changing their password to a truly weak one. The random strings that we generate gives a pretty decent compromise between usability and password entropy.