Depends on where they are. In a lot of places they're regulated just like brick and mortar places would be, that's why a lot of them are incorporated in, or get their gambling licenses from, shitholes like Curacao.
Of course there's an even bigger threat to these places than regulators: internet autists. There are plenty of people out there who track and calculate the RTP from various games/sites and if it deviated too far from the expected (like say the site was blatantly rigging it), players would know in short order.
Aside from some of the scummier crypto ones that are aiming for a rugpull, there's no percentage in it for the casinos to rig shit, the very nature of the house edge means they'll be raking in more long term. Stake does $2.5+ billion in revenue a year as is, you really think they're gonna risk that by blatantly rigging shit (except for what they do to my nigga BMJ, which is obvious bullshit by that rat bastard Eddie)