No stuff is one thing. Different stuff deployed to client's url is quite another.
If the domain is registered with the client named as the formal owner, the client may well be the owner even if they haven't paid for it yet.