APs are normally programmed based on the market they're sold into. Client devices receive information about which regulatory domain they're in from the AP they're connecting to.
Can't imagine mom and pop shop on aliexpress is programming APs individually based on the recipient address.
There's no technical mechanism to prevent someone operating an AP inappropriately. That's more an opportunity to discover how effective your local enforcement agency is.