I am sorry, but we are finger pointing because Paradox are the ones who are paid to support you, through the direct revenue that they get from sales of the game. They get their slice in part because it is their job to deal with problems in their area of distribution. Paradox are the ones who have relationships with the stores there, and if anyone can investigate a problem with reusing boxes, then it is them. It is not in any way easy or prudent for us to talk to a store halfway across the world which we have no relationship with and which doesn't know who we are, about a single box of a game.

If you had bought directly from us it would be a different matter, as we have more control over the billing and serial allocation. Similarly, for American distribution, we
are the publisher and can talk to our distributors. In Europe, though, once we deliver the gold master and the list of serials, it is up to Paradox as publisher to ensure that you have a satisfactory experience. That is what a publisher does.
We have undertaken to them to provide software updates and technical support to the first person who registers that serial. That is the extent of our responsibility. You
may be able to get an additional serial from Paradox, and they can then try and recover the costs from the retailer involved. That is
their responsibility, which is why we are telling you to talk to them.
The license for an individual serial is not transferable; check the EULA.txt file - indeed, check the licensing agreement for just about any software product, game or otherwise. It is not possible for you to legally own a copy of a game with a serial that was previously registered by another person. It was never possible to for the original owner to transfer it in the first place, unless they had written permission from us to do so, in which case their account would have been delinked from that serial number. Game stores like to ignore that fact because it is bad for them to have to say "sorry, you cannot return this game because you used it", but those are the conditions under which the software was originally licensed.
We do not call our patches patches precisely because that is not what they are - they are updates, which may include both features and bug fixes, but tend to include more of the former and less of the latter as time goes on. I'm sure there are a few bugs fixed in 1.2 that are not fixed in 1.0X. However, I'm not sure where you're going with the security concern, as the only net contact that happens is an outgoing web connection to Stardock to transfer game results for the metaverse.
Uberturkey: We than have to deal with the people who make up receipts, and the old user email addresses that are no longer reachable (but then we get complaints a month later that "my updates stopped working"). Licenses are not transferable precisely because it is a hassle that is not worth our time to solve. If it were a $500 software product, maybe. It is not. I suspect I pay more for my lunch than than we get from a European sales, and I'm not a big eater, nor is food expensive here.