

No. It’s not random. SLAAC uses EUI-64 by default, it generate fixed /64 suffix from MAC. And with suffix match of nftables you can still do device specific income firewall rules. For random privacy address, it’s only used for outcome so just block all other income of IPv6 addresses except EUI-64 is enough.
Please read this article authored by maintainer of Linux kernel memory management subsystem and cgroup subsystem, Chris Down.
https://chrisdown.name/2018/01/02/in-defence-of-swap.html
And there is another article with some additional informations about swap authored by @farseerfc@sn.angry.im who tranlated the article above to Chinese.
https://farseerfc.me/followup-about-swap.html (only Chinese version available)