The transaction hash is determined by the contents of the transaction. As such the payment sender determines the transaction hash so it is not random.
But the SatoshiDICE bettor does not know the secret that SatoshiDICE will use and the result of the hash after including the secret is for all practical purposes random.
To know that SatoshiDICE didn't cheat, the hash of the secret is known to the bettor in advance and then released the following day. So the bettor can verify that correct secret was indeed used, and with that verify that the correct payout occurred.
Since SatoshiDICE wagers are bets against the house, all that is needed is a way to determine that the house properly made each payout. This method of using the transction hash plus secret (revealed at a later time) succeeds at providing just that.