The problem with that approach is that people are very bad at remembering random strings of text, so they're likely to write this down or copy it somewhere on their computer.
Depending on the attack scenarios, that may not actually be more risky than allowing users to choose their own password..
I'd say that the best compromise of these approaches would be to encourage the use of password safe programs which at least store the password list in an encrypted format on local machines (of course this still relies on the user choosing a strong password for the password safe..)
Typically attackers do this during an offline brute-force attack (where they have a copy of the hashed password, probably along with other user information from the database).
The attack is done by getting a list of plain text passwords and then running them through the same hashing algorithm as was used originally (adding the salt value if present). Once the attacker has done that they just compare the hashed strings. If they match then it'll be the same password.
Commonly the attacker would start with a dictionary of common passwords and submit them along with common variants (eg, password, Password password1 passw0rd).
If that's not successful they can move onto pure brute force (eg, a , ab, ac, etc)