After checking the Android source as per Robert's suggestion, it looks like the ID is derived from the device name, which is derived from the device's place on the USB bus (specifically, bus number * 1000 + device number).

Some light googling suggests that this renders the ID assignment behavior dependent on the device kernel's bus/device# assignment behavior when a USB device is attached.

So I'd definitely have to assume that IDs might be reused at any time.