Nothing that I'm aware of, but nothing stops their users from using regular Chrome if the payments dry up.

There is also scope for click/view fraud also

Even if the original token pool is a fixed size, they could choose to issue another token pool later, so different token types could have different values

Other parties could use the same token scheme for their advertising and not pass anything on to their users

The whole area is intriguing