> Also cards are mostly used for gambling games and it's a huge security hole to use a third party api

Depends. If you're writing a game you wanted the player to trust you might want to use an external shuffling service so you can easily show proof-of-deck after the game is over.

Of course, you could do this simply by giving the player a cryptographic hash of the shuffled deck beforehand, e.g. SHA-256(5H,4D,AS...)

I've worked as a developer for online gambling games for 6 years. We never shuffled the deck of cards. Instead, as player requests another card(s), they are generated using hardware RNG and returned to player. Deck only knows which cards are left in it, but their order is undefined until that call to RNG.

If I'm not mistaken, this sounds like an incremental fisher-yates shuffle.

You are correct. As the matter of fact, a bunch of games in majority of cases needed only the next card from the deck, that's why in our heads we almost always thought of "not shuffling at all".

How is that better? You just don't want to spend the time to shuffle a deck if only a few cards will be used? Or you are worried someone might cheat by being able to read card order ahead of time?