Presumably the fact that they video the machine shortly before using it means that they’re relying on the fact that the hardware randomness is low. They implied

Presumably the fact that they video the machine shortly before using it means that they’re relying on the fact that the hardware randomness is low. They implied that it wasn’t 100% effective, simply effective enough to make their odds better than the house’s. In cryptography, `/dev/random` is preferred to urandom since it blocks when one doesn’t have enough randomness. The machine doesn’t have randomness sourced from user input between the videoing and the attack, so all it has is relatively-low-entropy randomness (at least, within a small timeframe) such as ambient heat. I could definitely believe that this is very hard to defend against without a dedicated hardware randomness source or blocking when entropy is low.