We have one wholesale customer that is able to purchase products that are in the database but are unpublished (because they are out of stock). I thought that they may use a cookie editor to add those products (the item, description, and price matches) and then go back to the website and continue with the checkout.

Is this a possibility? If yes, then is there any way to prevent them from doing this?