I was having a chat about this with a UX guy. His argument for using a similar flow was that the username/email will have to be validated at the point of registration anyway so you might as well make it easier for the user when the email is wrong. I couldn’t really refute this logic.

If you throttle both login and registration, then surely the risk is minimised while keeping the user happy?

Believe it or not, Valve do actually make games too, and these games do contain lootboxes. From the article:

…attorney general’s office called out Counter-Strike 2, Team Fortress 2, and Dota 2 specifically

They have been burnt for this in some other countries in the past and so they have developed alternatives which are location specific. Not sure if New York would’ve been too specific a place for this to be enabled or if they just didn’t care enough here.

Valve do have a history of popularising shading monetisation techniques e.g. battle passes. They are better than a lot of the competition, but far from being the saint that a lot of gamers believe them to be.