I'm not sure what the lesser evil is.
Both ways have their drawbacks. Imagine that USB stick gives out during a train show...
I myself was unfortunate enough to receive a defective USB Stick in 2020 (it was not recognized by any one of my four PCs). It was absolutely bizarre how Herr Freiwald handled the replacement procedure. As a result, I still to this day do not have a functioning USB-Stick.
Having the option of license verification though the internet rather than the USB dongle would have saved me a lot of aggravation.
Of course, it should be portable from one PC to another - I'm sure that is the case, as long as it only runs one instance at a time.
It is still hard to wrap one's mind around why, with all the IT businesses that have figured out a customer-friendly way to keep track of their licensed users, TrainController makes it so hard for its clients to use the product - not to mention the most unaccommodating client service if something goes wrong.