And then what?

Does the Microsoft store imprint an identifier into the network traffic of all the binaries downloaded from it?

And if so, how?

All of ngrok's traffic is TLS encrypted which means that only the client software and the server/peer should be able to decrypt or modify it.