The company points to a recent Dev Center document emphasizing Windows 8's optional app receipt system, which can require any transaction be validated on the developer's server.
ENGADGET: Microsoft pins Windows Store app purchase exploits on insecure code