Correct. MD5 doesn't provide much security, as you can brute force the entire 48-bit space of MAC addresses rather quickly. (And as you point out, the relevant space is even less.)

They could combine the MAC with some other identifiers, like perhaps the product key from Windows or disk volume serials and hash that together.