@Jeffro - Yes exactly.

I'm not condoning this practice I'm just saying it can be done. And because it can be done (within the attention that the theme developer puts in to keep a included commercial plugin up to date in their theme). Perhaps a rethink is needed or at least attention needs to be had by those using a similar model to GF in the future.