Thanks for fixing this . IIRC I initially added this because touchend fires faster than click on touch devices (I think there's an artificial delay to prevent touch).
On the one hand I wonder if it's better to just leave it off, on the other hand there's probably no real problem with having it generate 2 passwords in a row so long as there isn't any jank in the UI; I presume you tested it - if there is no noticeable delay between touchend and click, i.e. you don't see it generate 1 password and then change to another a fraction of a second later, then I'm happy to merge!
Throttling might be a bit overkill . I'd say click will do the trick just fine, it'll work everywhere and on mobile it just means there's an ever so slight delay, but really shouldn't impact the usability.