A raging debate has ensued in the Completed Games forum within the Diamonds in the Rough thread. When Alkis (of Other Worlds fame) announced that he would only be making his game available as a boxed CD purchase and not as a download of any kind, a lot of people started complaining.
It's an unusual move, but of course, setting up one's own download site is not trivial either. For both type of sale you have the overhead of an online store, but on top of that you need to provide a way for people to download their purchase that is easy for them, but also means that others cannot hack in easily. And although the copy protection on a CD is unlikely to be harder to circumvent than a download, at least there is a psychological difference between illegally copying a CD and copying something you just downloaded. However, if you use a popular webstore software on your site, like osCommerce, you may well find that download controlling is included, or a free add-on.
There are a number of things that one can do to prevent copying of AGS games. Phoning home is not really possible, as AGS doesn't really support net connections. When Dave Gilbert's games are sold through Playfirst or Big Fish, I believe they use the Software Passport suite to allow timed demos and then code activation. However that software, although free to try, is very expensive for one small commercial project. I think the best way for authors to protect AGS games is to put a unique identifier in each copy of the game they sell, at least that way when a pirated copy becomes extant they can name and shame (and sue!) the guilty party. Possibly one could also use some kind of encrypted activation key that combined with the unique ID.
No software protection scheme is foolproof, but one needs to have enough there to stop the indignant ignoramus who thinks "Hey, why should I have to pay for this, all other AGS games are free!" but is unable to hack at all.