Not unless their JS has ajax calls in it. But technically yeah they could, but, it's a pretty stupid fucken idea considering it would be found out almost immediately and suddenly it has become a blacklisted addon, their reputation has been destroyed etc.

Additionally you could just not update the addon ever if you're OK with it right now.