It's even worse, it's loot box style. Not pay to win, but pay to have the chance to win. The result will always be non-deterministic, so for some cases it can give you what you're looking for from the first time, or it can take 1000 tries.

It’s never not been “loot box style”. None of your past hired security audits were guaranteed to catch all issues?