Most people who talk about this tend to have no idea what laws already cover gambling.
I think that, in this case, loot boxes should be treated like slot machines as far as minimum payout goes; in Nevada (for example) this is minimum 75% by law- meaning that the house must ultimately return 75% of the value it takes in as winnings to its gamblers.
As these systems are effectively slot machines (put coin in, pull handle, get box), not much more needs to be done other than applying the law as written.
It might be tricky to establish a dollar value for the digital assets paid out, and would add overhead to assets distributed in this manner (how one would put a price on "asset that changes the way the game works" is, of course, an open question), but provided it's done properly should clamp down significantly on the anti-consumer aspects of these practices- which is, I suspect, the real reason everyone complains about this in the first place.