Appropriate sources of entropy

if there is no other traffic involved then you may have a point, but if there is no other
activity happening on the server other then what's initiated by the bad guy, there's nothing
interesting on the server for the bad guy to get.

if the server is doing anything else (talking to anyone else on the network, doing processing
of some kind, etc) then you start having things happen on the server that are not controlled
by the bad guy