unfortunately very easy

the issue is that the payment key can be derived without paying (as the event has all the data needed). to fix this you need a server that verifies the payment and only gives the payment key then