The fatal flaw of course is that everyone accessing their stream gets the same random data, making it substantially less random in the sense of others not being able to predict it. So do not use for cryptography!
They're not very explicit, but their FAQ indicates that they are buffering random data and they sometimes even turn the generators off. Which would suggest that they're not repeating the same random data to multiple users
Interestingly most clues about how their system work are given in the 'paranormal' section of their FAQ on https://www.random.org/faq/
I'm not a crypto expert. But I do know this stream is a firehose. Somewhere on the site is says how much data is generated. I forget. Naively I would think at least for some applications there would be no way to determine what part of the stream had been sampled. And the stream connection is over https.
