The user generates a random number n for their private key.
They use elliptic curve point scalar multiplication by n to generate their public key: they add a known generator point P for secp256k1 with itself n times.
Then, to generate the address, we hash the public key nP with SHA-256 first, and then with another hash function called RIPEMD160.
SHA-256 makes the address quantum resistant, as quantum computers could possibly be able to break elliptic curves and reverse the one way point scalar multiplication we defined, but quantum computers cannot reverse hash functions.
RIPEMD160 then shortens the address size from 256 bits to 160 bits.
Now you might be wondering: given a public key nP, is it possible to get the private key n? This problem is known as the Elliptic Curve Discrete Logarithm Problem, and is known to be computationally infeasible.
So, we can safely say that our procedure of generating public keys from private keys is fairly secure.