> Unless they know what counter you're using or you make it public, it's unreasonable that anyone could mess with your counter.

...or you choose convenient, meaningful $group and $id names, which makes even unintentional collisions not at all unlikely.