I think you're thinking from the browser level. I was thinking from the standpoint of what I could do as an extension developer.

If we approach it from that angle, then your extension can only restrict access to it's features via a round trip to your own servers to validate access and/or show a checkout view to purchase access.