If you have keccak256('eip1967.proxy.implementation') the preimage is known, it is 'eip1967.proxy.implementation'. If you subtract one you get a random number with unknown preimage because keccak256 is a cryptographic hash.
2 Likes