On the other hand, once Debian does due diligence, people can link up the findings on discussions of other distros. Most distros don't care about investigating

On the other hand, once Debian does due diligence, people can link up the findings on discussions of other distros. Most distros don't care about investigating those issues, but most distros also don't want to distribute code with clear legal issues. Also it's usually pretty straightforward to solve most of those problems. Cease distribution and contact the authors, and if they are unresponsive either replace the troublesome code (if it's trivial), or patch the program to not use the code (if it's not the main thing the program is about), or give up packaging the program in the official repositories.