$safe isn't necessarily needed here, only if you have unknown content that are going to be evaluated 'twice' like that $rand, except $rand cannot return something dangerous.
timer1 1 1 /timer2 1 1 msg #mirc $!rand(1,20)
when you do that, the timer1 command will gather its parameter, what are the parameter of the /timer1 command here? it's "1" "1" "/timer2" "1" "1" "msg" "#mirc" "$!rand(1,20)"
$!rand(1,20) is an identifier, so it gets evaluated as "$rand(1,20)"
So the parameter of the /timer1 command are "1" "1" "/timer2" "1" "1" "msg" "#mirc" "$rand(1,20)"
And from that point, it will register that its associated command is "/timer2 1 1 msg #mirc $rand(1,20)", when that timer fires, mIRC execute:
/timer2 1 1 msg #mirc $rand(1,20)
Again, the paramater of the /timer2 command are gathered, $rand(1,20) is evaluated to let's say 6, and the associated command of that timer is "msg #mirc 6", you want it to be "msg #mirc $rand(1,20), if you have two nested timer, you want two '!!' : $!!rand(1,20)