If the CD was free, it would make a nice coaster, I suppose. If you paid for the CD, then that's probably another matter, but oh well. Legal or not, it just doesn't make a whole lot of sense. Deb files pretty much flow like water all over the internet. Unless this is aimed at people with dialup, I don't know why they'd expect anyone to pay. Even then, if I was using dialup, I wouldn't be using Debian.
Having said that, it would be pretty ironic if someone cracked the encryption and wrote a GPL licensed program to decrypt the CDs that this company distributes.