When null is passed to SecureRandom algorithm in getInstance factory, then NPE is thrown.
However spec (see in comments) is silent about this behavior.

SecureRandom.getInstance(null) -> throws NPE
SecureRandom.getInstance(null, DrbgParameters.instantiation(-1, DrbgParameters.Capability.NONE,null)); -> throws NPE.

The getInstance variant which has only String parameter throws NPE for older java version up to 1.5 (i believe) as the stack trace gives info that it is originating from java.security.Provider#getService which is introduced in 1.5

The tests under development, attached the test case.