Usually it is more like "legal needs to be notified anytime third party dependencies are updated with a list of the licenses to make sure we aren't accidentally

Usually it is more like "legal needs to be notified anytime third party dependencies are updated with a list of the licenses to make sure we aren't accidentally using GPL or proprietary code". Other times legal gets involved earlier at the planning stages in case a feature or product falls under HIPAA or similar regulatory framework. Actual code itself doesn't cross legal's desk anywhere that I know of.