Why is this captch_code a string instead of a byte after the loop ends?

Question

Isn’t this captch_code taking a random character each time in the for loop? Why does it become a string when it is stored in the session after the loop ends? There is no splicing.