It's even harder to get away with pirating fonts now with web fonts. Either the service can detect you pulling a font for a domain that isn't paying for it or webcrawlers will find unpaid fonts.
A downloadable file can be hosted elsewhere.
"Pulling a font for a domain"—wtf, isn't the client making the request? Why detect anything, just require a referrer on your allow-list, and deny if it's not there.
>> Either the service can detect you pulling a font for a domain that isn't paying for it...
Is that really a thing? Markup in a web page tells how to display the text. Saying "use this font over here on this other server" seems fair game on some level. Might not be on another level, but it's technically the end user downloading a file that's publicly available on some server.