When industry won’t act to regulate abuse on its own then the only body that can (and should) is the government.
Gambleboxes target whales and children, people who lack impulse control in purchasing these gambleboxes. There are multiple stories of children draining their parents bank accounts and gambling addicts draining their savings into these games. The game companies target them, calling them whales, and these strategies work because they make billions in these gamble box purchases.
Saying "it’s only cosmetics" or "most people don’t do this" doesn’t matter - there are people exploited by this type of monetization, and industry does nothing about it.
Further, it goes into targeting children by placing these mechanisms in all ages games. Sure, you can argue all you want that parents should control what their kids do, but that’s what the rating is for. If the game makers don’t flag this as something for parents to keep their eyes on, if ratings boards can be gamed by developers adding these gamblebox implementations after the rating has been issued, then the only place left to act is the government.
Exploitative behaviors make video game producers massive amounts of money - it’s against their interests to regulate it.