Short answer: the DRM is always triggered by the code in gui.rpy when you launch the game, but doesn't do anything even with care packages installed as long as they've been cleaned of unique IDs (like the ones in the OP). But you never know what the next DRM will look like so it's a bad idea to apply new updates to a game installation that contains pirated subscriber-only content.
Or block the lil.exe in your firewall. Though, don't know Ren'py's/Pythons capabilities, so he could try to call a different exe.
Just that naturally, as far as i know, windows can't FW block entire directories, so you'd have to search lil dir for all possible exe's, or get a 3rd party prog capable of doing so.
Gotta say i wonder if he has the drm armed still. As you also think, Sel/the guy who dev'ed it very lilkely does this by IP's (No unique user ID's/authorisations are involed).
- Is IP storage even legal in the US?
- Might this be the reasons some legit users got their saves deleted? (Playing on devices with diffrent WAN IP's?)