Sort:  

Matt mentioned about trying to set up the random to be based on transaction ID or something.

What gets logged on the blockchain is only for auditing purposes, everything is done off chain.

I think it is ok to have the game logic off-chain. It would be good however to decouple the transactions you do from their website. But I do think that this is mainly a question of priorities. Also, I would hope that they make the whole project open on github, so that the code can be reviewed.

So, they can just print cards as many cards as they want to?

while true:
   transfer_50SBD_to_myself()

No need for an if condition there

I wrote a small blog about why I think steemmonsters cards are worth actual money.

You can check it out https://steemit.com/steemmonsters/@tsnaks/are-steemmonsters-cards-actually-currency