You could theoretically write an 'install bombing' tool that sends fake install notifications straight to their server (or modify the game executable to do it repeatedly). You can't trust the client, especially when dealing with PC games.
Hopefully Unity will anticipate this potential abuse, and filter out repeated 'installs' from the same IP address. But they don't seem to have anticipated free demos, pirated copies, Game Pass, or charity bundles before announcing this...