I think legal jurisdiction matters in discerning these things. The EU or US both have courts that, despite anyones opinion, are regarded as having robust contract enforcement. If Fireworks is domiciled in either then claiming ZDR and instead training on the data would be an enormous financial footgun. There's reasons why companies on both sides of contracts, even those with little to no US or EU activity, agree to use US or EU courts for enforcement.

Hong Kong I think used to be a popular option as well, before the handover from the UK.

Being terminally 'online' can make people cynical about everything, but have to temper things with reality a bit too.