I didn't look at how they make users pay but if it's not in app purchase they do not have a way to distinguish between legitimate and illegitimate users therefo

I didn't look at how they make users pay but if it's not in app purchase they do not have a way to distinguish between legitimate and illegitimate users therefore they must accept all server requests or none.