Every state has a requirement that an out-of-state entity that is "doing business" within its borders register with it as a foreign corporation (or LLC) as a pre-condition to transacting such business.
While the requirements vary from state-to-state, there is always some minimum threshhold that must be met, whether it consists of having a physical presence in the state, having employees in the state, accepting orders in the state, or anything else the state authorities consider a minimum threshhold.
Internet companies, like any other, must register in every state in which they are "doing business" in such a way as to meet the minimum threshhold for that state. Very often, they do not meet the threshhold requirements and thus do not need to register.
You are correct as well that these laws are not necessarily strictly enforced. The normal penalty for failing to register as a foreign corporation, for example, is that the entity cannot sue or defend itself from a lawsuit in the state until it does register. However, an entity can usually cure this problem by registering after-the-fact (and can then avail itself of the courts as needed). This system sometimes causes companies to be lax about doing such registrations even when they technically should do them.
That said, as a rough rule of thumb, most companies do not normally need to register in the various jurisdictions unless they have a physical presence there. Best practice is to consult with a knowledgeable lawyer on the issue to make sure.