Is the following reasoning correct? If not, why not?

If someone copies a database to their own FB installation and the app
request a user/pw in order to run the app, then that someone would just
have to enter their own SYSDBA/masterkey combination and be able to run
the application.

If it is encrypted in the application, then that would make it more
difficult.

Raymond Kennington