Well, unless you actually restore a backup, it won't leave the cluster, that's quite a given. But a NIC can easily be replugged to another bridge.. I guess if it's more of a marker, and if you make sure you don't reconfigure the NIC it's fine, but there are many cases where you'd change that.. Creation (or clone) is easy, but you'd need to either say you don't care after, or deal with what would happen if it switches networks!
And yeah, random_ether_addr is written and mostly called (with prefix) in Perl, so you'd need to hack around it, but maybe ask on here, on pve-devel or on the bugtracker if that's something that would be interesting at all, as I'm not sure this is super relevant, but maybe that's just me.