Can any installed bundle be removed by the bundle provider without the administrator manually uninstalling a bundle himself from an account ? is it possible for bundle developer to manipulate installed copy of the bundle in any way without the consent of the administrator  ?

implement a license check

alright . license check would disable the scripts ? what about custom fields , custom records ? would they be removed as well if license expires ?

id think very carefully about modifying someone else's data