Per install, not sale, which includes demos, pirated copies (yes, really) and, say, a web browser spinning up the browser version of a game. Or a cloud service running it in a VM (each executable startup in that case is an "install"). Or any download from a service like gamepass.

Above all, a single player/user redownloading the game on their device counts as a separate install. They've now said that they're using proprietary "fraud detection" and IP address uniqueness to prevent fraud, and seemingly requiring devs to reach out if they think they've been overcharged.