- It's cheaper not to check on every call sever-side and the people who are most likely to dodge in this way are also not likely potential sources of revenue.
- you shouldn't ban every person who tries this. They will gum up support and, on average, won't even be trying to earnestly get features for free.
- Also people who exploit the obviously vulnerable account interfaces may do other things that clue you in to vulnerabilities you care about.
It seems like it's a situation where you can let people fiddle around with this a bit (a few hours, a few days) and ban folks who do it too long (a month?). People who use it heavily are unlikely to be real revenue prospects and, at the end of the day, it's an engagement funnel. People rarely use hacks on a platform they aren't using.