Are theoretically sound pseudorandom generators used in practice? As far as I'm aware, most implementations of pseudorandom number generation in practice use methods such as linear shift feedback registers (LSFRs), or these "Mersenne Twister" algorithms. While they pass lots of (heuristic) statistical tests, there are no theoretical guarantees that they look pseudorandom to, say, all efficiently computable statistical tests. Yet these methods are used indiscriminately in all sorts of applications, ranging from cryptographic protocols to scientific computing to banking (probably). I find it somewhat worrisome that we have little to no guarantee about whether these applications work as intended (because any sort of analysis would likely have assumed true randomness as input). 

On the other hand, complexity theory and cryptography provide a very rich theory of pseudorandomness, and we even have candidate constructions of pseudorandom generators that would fool ANY efficient statistical test you could come up with, using candidate one way functions. 

My question is: has this theory made its way into practice? I would hope that for important uses of randomness, such as cryptography or scientific computing, theoretically sound PRGs are used. 

As an aside, I could find some limited analysis of how well popular algorithms such as quicksort work when using LSFRs as a source of randomness, and apparently they work well. See Karloff and Raghavan's "Randomized algorithms and pseudorandom numbers".
The notion of "theoretically sound" pseudorandom generators is not really well defined. After all, no pseudorandom generator has a proof of security. I don't know that we can say that a pseudorandom generator based on the hardness of factoring large integers is "more secure" than, say, using AES as a pseudorandom generator. (In fact, there is a sense that it is less secure, since we know of quantum factoring algorithms but not quantum algorithms to break AES.)

What we do have mathematical proofs for are various composition results, saying that if you compose block-ciphers or hash functions in certain ways you can get pseudorandom generators or pseudorandom function. Some such results are widely used in practice, e.g., HMAC. But it's true that the results that achieve a PRG and start with just assuming that the basic component is a plain one-way function are not efficient enough to use for applications (and this is at least partly inherent). So, typically we need to assume a  PRG/stream cipher/block-cipher/hash function as a basic primitive, and start building other things from it. The issue is not really about asymptotic analysis since essentially all cryptographic reductions (except perhaps for Levin's universal PRG) can be made concrete and so give concrete guarantees under concrete assumptions.

But even though they are not based on one-way functions, there is a sense in which constructions such as AES are "theoretically sound" because:
(1) There are formal conjectures about their security.
(2) There is work to try to refute these conjectures, and also derive implications from them.

And indeed, people are aware that for many applications, it would not be smart to use PRG's such as LSFR that do not satisfy (1) and (2) above.