Everywhere I read, indistinguishability of output from true random is stated as a requirement for CSPRNGs. However nobody bothered to give the rationale for such a strong requirement.
Specifically, Yarrow and Fortuna both use a block cipher as the generator, and both limit the amount of output that can be produced by a particular key. The key is changed (aka rekey) once the limit is reached. Their reason is that since the block cipher does not generate duplicate output blocks in their design, the attacker can request for a large amount of output from the PRNG, find that there are no duplicate blocks, and determine that the output is not true random. So what?
The only information the attacker can get from this is the cipher's block size, and this doesn't weaken the security one bit. Furthermore this would have been public knowledge if the implementation was open source. I don't see how the lack of duplicate blocks would weaken our security.