Updates come through Composer
The plugin is not in the Shopware Store, so it has its own channel: a private Composer repository you add to your project once. After that composer outdated lists new versions and composer update installs them, like any other package, and Composer verifies the checksum before it unpacks anything.
The download address deliberately does not expire. Composer writes it into your composer.lock, and a link that died after a day would break the deploy you run next month from a lock file you committed today. There is no licence key in the plugin, no countdown and no kill switch: if a subscription lapses the plugin says so to the administrator and the shop keeps selling.