Amusingly, Apple and Google might be the first serious regulators of those.

https://www.csie.ntu.edu.tw/~hchsiao/pub/2024_ACSAC_lootbox....

"Verifying Loot-box Probability Without Source-code Disclosure"

Just read the abstract