Well the code that I posted doesn't do It, but yes.
Anyone can do this sadly, even on Oxide, and on RustEssentials. It would be hard for anyone to bypass this. The host can do this by simply getting the current slots of the server, and checking if it equals with the slots that the person paid for.