PID is short for ‘process identifier’. That’s exactly what it is, a way to ‘uniquely’ identify a process on the system. Note that I have ‘uniquely’ in quotes here. This is because a PID is only unique for the lifetime of the process it is assigned to.
As far as how a PID is chosen, it varies by system. The original approach is to simply assign the next number that has not been used, up to some maximum value, and once you get to that max you start reusing previously used but currently unused numbers, starting back from the lowest such number again.
Linux takes that original approach, because it’s simple and fast. The downside is that some poorly written software may rely on PIDs in ways that it should not (such as using them to seed an internal random number generator or create a temporary file name), which allows for some potentially nasty local exploits if you’re using such software (but such software is thankfully increasingly rare).
Some systems, such as OpenBSD, instead pick PIDs at random from the currently unused values between 1 and the maximum. This eliminates the local security issues, but in exchange it slows down creation of new processes, opens you up to random users on the internet potentially nasty things (such as the exploit outlined in this security Stack Exchange question), and possibly breaks software that expects PIDs to not be reused quickly.
Others, like FreeBSD, allow you to choose either approach, or alternatively use a middle ground. This allows you to pick which particular set of security issues you want to deal with (hint, it’s probably the local issues, not the remote issues), or even choose a middle ground (which is usually the correct choice).