Technically there's no reason to sell it as a physical SD-card containing the game in order for the DRM to work. They could always just offer a downloadable version, which can only be unlocked with a registration key tied to the SD card or gp2x unit (I assume it's possible to identify individual units as well, not sure about that).
I've got some gps app for my palm that works exactly like that. Go to their site, enter the numbers displayed on screen when your app starts, and you get the unlock key sent to your email address under which you registered the application.