If the dev tells you "information gathering is deactivated for users who pay." you won't believe them, you'll just move the goalpost and ask that they prove it by releasing their code, which they won't do because their app isn't open source and you'll conclude that because they won't prove it then we should just assume that they do.

That's JAQing off and that's exactly where you were heading with that first question. Guilty until proven innocent, but you don't accuse directly, you're Just Asking Questions.