I agree that it's shitty that buyers can lose access to a game they bought, but I really struggle to see how this could function practically.
Nowadays, this is much less of a "can" and more of a "definitely is" :(
Based on what I see as (non-game) security consultant in terms of service complexity, what modern FOSS projects consider a normal container constellation, and on what I see from at least one indie dev whom I personally know. It has been a topic I've brought up since he put so many hours into it and the game is fun and the binary didn't even run if you don't have a compatible Google Play Services version, much less the various back-ends that it connects to for accounts, level data, level thumbnails, matchmaking, etc. until you even get to the real-time multiplayer server
In practice a lot of those components can be simplified when you don't have to support a huge number of players. A server that only supports dozens of players can just use SQLite instead of a big multi–az database cluster. The cache can just be an in–process cache instead of a connection to an external Redis instance, etc, etc.