> Where does the money come from
The magical credit card fairy. Parents who aren't into gaming or technology may not be aware of the risks that these games pose, and therefore are unprepared to properly supervise their children when playing such games. Historical methods used to signal parents like ESRB / PEGI ratings are deliberately unhelpful in the regard as they draw no distinction between gambling mechanics and more straightforward purchases. And even then those are fine-print addendums that don't impact the actual age rating. So you wind up with a situation where games with gambling mechanics are rated by PEGI as being suitable for children 3+, leading many to be unaware of the risks a particular game poses. In comparison, a game that introduces "real" gambling with cashout possibilities gets an "Adults Only" ESRB rating as a matter of course. And even those flimsy addendums are actively circumvented by game companies who will wait a month or so after launch to add in the gambling features, after the game has already been rated and warning labels have already been printed.
In contrast, things like card packs or stickers are far easier to control. You give your child $20 and they can waste it as they please. Or they ask you for something and you buy it. Almost everybody intuitively understands that if you give your credit card to the child then you're playing with fire. Setting up a payment method in a game system is more risky in that credit cards are typically the only option (plus store gift cards that parents may not be aware of). Even so, it is not at all obvious to many just how much you can spend in a game. A child might ask for a $5 pack of loot boxes, and it seems reasonable. Then your numbers are in. If your child can then social engineer your password from you or get you to check the "don't ask for password" box then they have free reign. You might even knowingly do it because, again, it is not obvious that you can even spend that kind of money in a game.