The article is very non-specific. They may have distributed a runtime on a base image or the full application after the product went through a security review.

I had a case a long time ago where the sales organization for a company agreed, in writing, that they would meter usage based on sign-ins on the server, not installs. Long story short, the sales teams get laid off and the attorneys move in and want to be paid for each install. They lost and lost a bunch of recurring and future revenue as well, as we scoured our substantial install base and read a statement prepared by counsel to the 5 reference calls that resellers sent our way. :)