KMT refers to a three year old thread that addresses your question only in the last post (by me). Three years later your concern is still a flaw in the system. You can address it by writing something to the keychain since the keychain survives deletion and reinstallation of the app and also is unaffected by changing the "Apple ID". You then create two autorenewable subscriptions - one with the free initial trial and one without. If the keychain indicates the device purchased the subscription then only offer the second subscription.
But...that's lots of trouble to avoid the rare theft. And consider this - while it is a theft it is not necessarily a lost sale because the thief would most likely not have made the purchase were it not free. So if you have no 'cost of goods' maybe this better ignored.