Which makes me wonder is there a private key to those addresses?
Almost certainly.
could someone get lucky and unlock those bitcoins?
Almost certainly no.
If we take the address 1BURNbitcoinBURNbitcoinBURP3vqZJo as an example, working backwards along the process all we can say that is generated from a RIPEMD-160 hash output of 01FB0C820F0995E24AAD95DB98BA96BA28F4AD66. To work out the private key we would first have to reverse RIPEMD-160, then reverse SHA-256, then solved the DLP to get the private key. Alternatively, we would just need to brute force trillions upon trillion upon trillions of private keys until we stumbled on to a collision. Both are so incredibly unlikely as to be safely considered impossible.
I wouldn't install software for this, but if it can be integrated as an Electrum Plugin, it could actually work!
Now there's a nice idea, although the usual caveats with Electrum would apply - if you create a single signed transaction spending all your change outputs and send it via your Electrum server to the central server running this service, then which server you are using can link all your change outputs.