> that's fine so long as you have other entropy sources

Well, if you literally have nothing else, then you don't have an option anyway, so the whole question is moot.

Except yeah if literally the only way to collect entropy in your system is the platform's opaque RNG, then sure this means your risk assessment should list that as a SPOF. But by definition these cases only have that option, so you can't do anything else.

In reality, you can probably do something else in all but the most extreme embedded environments.