This definitely needs to be a regulation that's enforced in more places in the world.
In practice, how, with so many territories any given game can be in and/or operate out of as a business, someone smarter than me will have to answer.
I make no claim to be smarter than anyone, but I have worked in regulated "gaming" for quite a while.
If the regulation comes down like casino and online gambling regulation, the state/country/local agency make the rules and you figure out how to follow them. For example both Nevada and New Jersey jurisdictions, that approved online gambling, invested very significant funds in geofencing, geolocation, and proxy detection (such as it is) to ensure that sports betters were, in fact, within Nevada or New Jersey, respectively.
Employees of related industries like casinos are often licensed, I pay a certain amount every two years to have my tax records, legal records, and outstanding court records reverified to allow me to work. More significant roles of responsibility in the industry require more significant license ($1200 or so to get in the first place, $200 every two years to renew, due to all the background checks to ensure no whiff of fraud or criminal activity). This is just to work with the tech/games.
Casino games are tested by a national (and licensed) testing company in a process that takes several months, and then these tests are reviewed by the state's control agency which may voice its own objections to the results and send them back for further testing and adjustment. Recalls happen all the time and there are significant penalties (up to hundred of thousands of dollars, if chalked up on a per-machine violation) if a casino is too slow to replace recalled software.
All bets and wins are tracked, audited, triple-checked and reported so they can be taxed at the much-higher tier for this regulated activity, and thus are posted publicly allowing people to indeed math up the overall "odds" (or hold percentage) of the casino, broken down by denomination (and old metric, really). Reporting systems are also subject to the same testing company's approval, as is any system interacting with game tracking and reporting software. I once watched an international casino games and system manufacturer spend months and millions in development refining reports for the local state gaming agency before they could get approval and sell their CMS system upgrade in the state.
"The State" passes the law and you do what you have to to follow it and do business there, or face the law. That's regulation. All these same micro-transaction marketplaces find a way to detect, implement, collect, and pay sales tax when a jurisdiction demands it.
Compared to what's possible, I'd say posting your loot box odds on a page no one visits is fairly slight. I'm curious if China has investigators even now confirming those percentages, because with regulation, comes enforcement.