This protection system collects your Discord ID, VRChat username, and license key (from the original buyer), and transmits them to the avatar creator. It also monitors for what it considers "suspicious behavior" and can flag your account.
On top of that, some avatars using this system restrict you from making personal edits like blender modifications to something you paid for.
If you're in the EU, this is worth knowing: under EU consumer law, sellers cannot use technical enforcement mechanisms that go beyond what's reasonable for a personal-use product. Flagging users for editing something they legitimately purchased is arguably overreach. GDPR also requires proper informed consent for data collection.
If you have concerns, you can file a complaint with your national data protection authority.
And if they don't want to play ball the EU didn't write 88 pages of GDPR legislation just to let it collect dust. Your data protection authority exists for exactly this, so use them.