go-bip39 | The BIP39 library for Go | Cryptocurrency library

My question is, When people say that the keys not generated properly from random functions are susceptible to break, what they actually mean?

Bad randomness is attacked in cryptography in two ways:

1. By exhaustive search of the seed that was used to generate the stream of bits. A prominent example is the Debian OpenSSH vulnerability.

2. By attacking the predictability of random number generators that were not designed to meet cryptographic requirements. In statistical random number generators, the main requirement is that the data looks random. In cryptographic random number generators, we require more: given the stream of bits, a very smart person who knows the algorithm cannot figure out what future or previous bits for the random number generator are. As an example, although the Mersenne Twister has a large internal state, it does not meet the cryptographic requirement.

Your question about measuring entropy is the wrong question. Measuring entropy is treating it like it is a statistical random number generator, not like a cryptographic random number generator. You say:

GenerateRandomString and GenerateRandomSalt just generates random string and bytes based on crypto/rand packages.

That's all you need to know -- you should not need to worry about anything else. As mentioned above, no amount of measuring entropy is going to tell you that your keys are secure. Instead, you need to be a cryptographic expert to analyse such algorithms. For a consumer of the randomness, all you can do (short of using another source such as /dev/urandom) is trust that this has been designed well and analysed by cryptographic experts.