Why is a randomly generated hash safer than a user's session ID?

Question

User identification

Hello, I would like to clarify.
If an attacker steals the administrator session cookie, he will become an administrator himself.
Similarly, if an attacker steals a username and password.
Why then is it said that a random session hash is safer than a hash created based on, say, login+password_hash+sesure_string ?

Answer 1

harder to steal than picking up a sesure_string and then sorting through typical password hashes