If that case is beyond "who cares?", which I suspect is not, once the user is granted access to the news the first time then they can be given subsequent access regardless of referrer.

It can only be a problem for the news agencies – and only if those users are a significant number to impact profitability. If those users don't matter, restricting their access doesn't matter. Who cares if someone who isn't helping your bottom line can't access the content you expect payment for? That’s the whole point of this – to keep out those who are not helping the news business.

Now, each successful entrance into an article via allowable referrer would come with an access token to allow future access absent of referral. When sharing in the small scale, the news agency can simply allow these links to be shared. But if the reach grows wide, suggesting that a major tech source has picked up the link and should be using their contractually settled upon authentication mechanism instead, then the token can be invalidated.

Any IM service not operated by a major tech company that the news organization wouldn't also want to collect compensation from is going see such a small number of referrals, who cares? Same goes for the number of people who are going to take the time to hack around it. Who cares?