GUIDs/UUIDs are effectively unique. How unique depends on the version of the UUID. UUID v1 are completely unique unless someone intentionally forges your MAC address (an address associated with your network card, typically burned into the network card's ROM) or if your clock resets and you get very unlucky. UUID v4 are 122 bit random variables (UUIDs are 128 bits, and 6 bits are reserved for versioning, leaving 122 random bits). The one example output from GUID() that I found was a UUID v4, suggesting that's what it tends to return.
122 bits is a lot. If you generate around 1000TB of UUIDs (specifically 2^46 UUIDs), your chances of observing a collision is around 1 in 50 billion -- you're more likely to win the Powerball lottery!
Now there have been UUID v4 collisions. This was caused by poor randomness in a specific UUID v4's generator. I do not have any specifics on how Saleforce generates their UUIDs. In theory this could result in a collision. However, in practice, functions like GUID() were designed to be used as unique keys, so it's reasonable to assume the implementation is sufficient.
In the end, the answer is "never say never," but "eventually" can mean "some time after the heat death of the known universe."
