Maybe is in the metadata as someone pointed out earlier, or it could be an otherwise unused ASCII char that looks different for each user who licensed it when printed out, sort of like a qr code as a single ASCII char.
Or it could be that they simply just check filename, file size and/or md5, all of which can be easily changed.
That's why everything is an App now, and every website tells you "it's better in the app". In the app they have full controll over your device and can access much more data points, while the website is controlled on the users site and might have AdBlockers and other security features enabled, potentially hurting their ad revenue and data they can sell. From a developers perspective it's a nightmare to develop and maintain website, android and Mac os app side by side. Just having one good responsive website is cheaper, easier to maintain and gives you less headache with app store restrictions, reviews, device incompatibility etc.