128 bits seems like overkill: There's no birthday attack because no-one keeps 2^(ENTROPY_BITS/2) files around
You haven't seen my Downloads folder... :-)
I put it to you that those files are not temporary :-)
Why be so miserly with entropy?
I don't necessarily disagree.
Using 128 bits is just 22 characters using secrets.token_urlsafe().
A little more when you take into account case-insensitive file systems.