The ESRB is a voluntary self-regulatory organization, not mandated by law. Most "legitimate" video game publishers and retailers (at least in the US) follow its guidelines and use its ratings because the industry has collectively agreed to police itself under those guidelines with those ratings. Same goes for PEGI, last I checked. This is in contrast with (for example) the ACB, which actually is mandated and controlled by the Australian government.

That said, an "AO" rating would indeed have a chilling effect on store shelves (since most retailers don't even want to carry AO games at all). It could be feasible to make loot boxes an automatic elevation to ESRB AO / PEGI 18 / etc. should those organizations want to do so (and hopefully they would indeed want to do so).