I appreciate and largely agree with what you've said, but I think you're neglecting a context where there's an NDA or similar involved, which is what I assumed

I appreciate and largely agree with what you've said, but I think you're neglecting a context where there's an NDA or similar involved, which is what I assumed was meant by "even vaguely sensitive". As far as I know, there's no legitimacy to someone who's signed an NDA somehow sublicensing that NDA without the explicit approval of the issuer of the original agreement.