This is 100% speculation, but I wouldn't be surprised if it checks the length of the subscription when connected to a network, then tracks that with a built in clock. There's also incentive to frequently connect it to a network since the company constantly "updates the algorithm" it uses to detect crashes and deploy.

I suspect it would stop working once you hit the end of whatever period it knows you're "paid up" for.