I'm guessing you could probably evaluate 1000s of booster packs by grinding transaction order within a 3 second window. However, this also brings up another potential solution: using a key derivation function that takes 3+ seconds of computational work to generate a random seed from transaction & block info. This would make it impossible to evaluate booster pack outcomes within the 3 second interval. airBitz / Edge uses a similar approach to slow down brute force attempts to break into a wallet.
That's an interesting point about how DPoS does provide some protection because witnesses have their future earning ability at stake via their reputation. In a proof of work system, there is a large cost to forgoing a PoW solution because it doesn't generate the proper random seed. However, with PoW there is no reputation cost since blocks can be mined anonymously. In Steem there is no immediate cost to picking a block with the right block hash. However, there is a longterm reputational risk if you get caught.
So from that perspective I think what is implemented now is probably sufficient.
It will be interesting to see if good cards start occurring more than would be expected by chance!