Why does a physical noise source provide security against an attacker who knows the code, while a phone game shuffle does not?

Answer: It draws on hidden inputs an attacker cannot predict

Its output pattern looks evenly spread — An even-looking pattern is not the same as security. A deterministic shuffle can spread cards or numbers across the screen in a way that looks fair, yet someone who learns the algorithm and state may still predict the next result. NIST SP 800-22 treats statistical tests as a first screen, not as proof that a generator is safe for cryptography.

It draws on hidden inputs an attacker cannot predict ✓ — Security cares about what an adversary cannot know or reconstruct. A physical noise source can add fresh unpredictable input, so the next value is not just the visible end of a known recipe. That is why encryption systems feed randomness from outside the deterministic computer, rather than trusting messiness on the display.

It produces a much longer visible sequence — Longer output can make a sequence feel more random, but length alone does not create unpredictability. A short secret seed can deterministically generate a huge stream, and if the seed and algorithm are exposed the stream can be rebuilt. The decisive question is not how much you see, but whether the hidden input is unknowable.