New versions show up in composer outdated and install withcomposer update. Composer checks the checksum it got from the repository before it installs anything, so a package that was tampered with in transit does not get unpacked.
The download link deliberately does not expire, which is the opposite of how the WooCommerce channel works. Composer sends its own credentials and writes the URL into your composer.lock, so a link that died after a day would break the deploy you run next month.
A published release cannot change afterwards. Platform, version, package, checksum and publication date are fixed, deleting is refused and so is unpublishing. Correcting something means a new version number, which is the only way your lock file can stay meaningful.
No licence key, no countdown, no kill switch. There is nothing in the module that can switch your shop off. If a subscription lapses it simply stops receiving new versions, and what is installed keeps doing its job. We would rather earn the renewal than hold the shop hostage for it.