This doesn't hold. The timing of the VPN code widget is not a random variable, but rather fixed. Thus, sampling a random inspection time of the widget has equal probability of being in the 0-30s bucket as it does in the 30-60s bucket.

For a bus, the intuitive explanation is that if you were viewing a timeline, the biggest parts of the timeline would be the "late" buses, and thus you're more likely to "inspect" (arrive at the bus stop) during one of these longer stretches.

This is because refresh can't take negative time.