It is weird that it can get the associated account since it is new generated address.
const account = Keypair.generate();
let address = await Token.getAssociatedTokenAddress(
ASSOCIATED_TOKEN_PROGRAM_ID,
TOKEN_PROGRAM_ID,
token.publicKey,
account
);
The address generated from getAssociatedTokenAddress
is deterministic, so given the same public key inputs, it will always have the same output. Additionally, it is a program-derived address, so it can only be "signed for" by the program.
You can find more information about program-derived addresses at https://docs.solana.com/developing/programming-model/calling-between-programs#program-derived-addresses