I think it is (sort of) and the best signal may be not a legal analysis alone but the actual shift in the enterprise-backed communities. Ever since https://en.

I think it is (sort of) and the best signal may be not a legal analysis alone but the actual shift in the enterprise-backed communities. Ever since https://en.wikipedia.org/wiki/SCO_Group,_Inc._v._International_Business_Machines_Corp https://en.wikipedia.org/wiki/SCO_Group,_Inc._v._Internation.... Eclipse Foundation required what they call "Type B" IP scan for all projects (Eclipse F. is not just an IDE but a competitor to the Apache F.), essentially a deep scan of the code searching for any bits of GPL (our Eclipse project had a dojox dependency flagged because its MIT-licensed code contained a small snippet of GPL, that was the only time we got a rejection of a library). In late 2019, the change was made to make "Type A", a deep scan of the licenses only, to be the default (https://blogs.eclipse.org/post/wayne-beaton/updates-eclipse-ip-due-diligence-process https://blogs.eclipse.org/post/wayne-beaton/updates-eclipse-...). To me it signals that the common sense in the enterprise community now is that there is not much risk in that scenario, worst case would be that the original IP holder can force you to remove their code if they convince the court the developer had no right to publish it as opposed to getting crazy amounts awarded. I think it is also judged that the likelihood and the amount of trouble are relatively small compared to full code scan of all deps transitively at all times (incl lost productivity).