Honest question: what does it really take to get an affiliate account shut down?

If I understood how this works, it simply replaces the URL of the affiliate link on the page I'm viewing. If that's all it takes to redirect the affiliate payment, what's there to prevent a rogue Firefox extension that secretly replaces every amazon.com link with one that deposits into the author's account? How about a proxy server that scans for these URLs and rewrites them so they make the server's operator rich?

While it's good to see this being used for a good cause, it feels as if exactly the same method can be serving more nefarious purposes. Perhaps this will require oversight from the whoever runs the affiliate program, and I'm having a hard time imagining how they'd be happy if a third party is taking a cut of these fees.