And then what?

Does the Microsoft store imprint an identifier into the network traffic of all the binaries downloaded from it?

And if so, how?

All of ngrok's traffic is TLS encrypted which means that only the client software and the server/peer should be able to decrypt or modify it.

They don't need the encrypted payload just domain is the basis here as far as I can tell.