It's not the case that the final character is always a digit; it is a digit more often than chance, I believe, due to the fixup process that ensures that the password contains at least one digit. https://cs.chromium.org/chromium/src/components/autofill/core/browser/password_generator.cc?type=cs&l=60

I expect that limiting the character set is a deliberate design decision for compatibility with websites' password restrictions.

Using a fixed 15 characters as the length (PasswordGenerator::kDefaultPasswordLength = 15) is arguably a weakness, however, 62^15=768909704948766668552634368, an implausibly large search space for a brute force attacker.

As the user is presented with the candidate password (and this feature is off-by-default anyway), I don't think this is an Issue that needs to be kept private.

Thanks for the explanation in #1.
Based on that, I will close this bug.
The feature is being reviewed by Chrome security as part of the standard launch process.