They're bound to the EULA, but the EULA is meaningless because it's just a URL. They're definitely not bound by whatever's at that URL.
This would be like having someone sign a contract when the contract was just a shopping list. Sure, they're bound by the "contract", but the contract doesn't specify anything they can or can't do.
It could be changed at any time, it might not resolve properly, the page could be hijacked, an ad blocker could decide it's an ad and show something else instead...