How would we know that they are truly random?
I have vague memories of reading about this kind of dark pattern when I first heard about loot boxes, but I failed to google any references now so maybe my memories are diluted with imagination.
But why wouldn't it happen? How would the public find out? Tipping the scales just a little bit, at the right times, for the right victims, could be very effective at "increasing engagement". The whole thing would even be a/b-testable, so any internal arguments against would be futile. (You'd want to keep the "a" implementation around anyways, in case you need to present source to someone who should not see how the sausage is made)