Why does /dev/urandom not block?

Because its purpose is not to block. That's literally what distinguishes it from /dev/random. So you don't have to worry about blocking, but the bits you get from it may not be quite as random as those from /dev/random.

According to the man page:

If there is not sufficient entropy in the entropy pool, the returned values from /dev/urandom are theoretically vulnerable to a cryptographic attack on the algorithms used by the driver.

The man page adds:

Knowledge of how to do this is not available in the current unclassified literature, but it is theoretically possible that such an attack may exist.