Hector Martin

even if you don't have a verification failure against the old-block case, isn't a future blockhash dangerous because someone could mine a block, then fuzz its contents? (Assuming not very many bits are being read from the RNG, anyway)

I think the point is that the blockhash depends on the block contents, and thus you're increasing the difficulty of mining by trying to get a given hash. At that point it's a trade-off: how many bits do you need to win, how many mining rewards are you forgoing for what benefit.

isn't the hash in question also dependent on the transactions recorded in the block itself, though?

Yes, that's the point. So making any change there requires re-mining the block.