This is first time I’m using Elementor, in the past with other pagebuilders I’ve not had to use the Evanto Plugin which wants connects to external service. My client will not like this connection to external service as they will be concerned about data privacy being compromised by a 3rd party, it is a medical website with sensitive client information. Can I not just install Elementor and install Template, why all the complexity?
Chances are the use of the plugin is just to simplify the installation process and ensure automatic updates. You can always download the theme (www.themeforest.net/downloads assuming you are logged in) and install it manually.
There is little difference between connecting with the Envato plugin and most other common ones like contact forms or page builders.
It’s possible (without seeing the theme it is impossible to say) that the author loads certain plugins or features from their server/repository, as part of the installation/setup process, but this is no different than installing another plugin.
With respect to your client - using a stock marketplace theme where very sensitive and confidential personal data or records is in play is just irresponsible. Presumably they have decent hosting and server security in place which would minimize any threat.