Yikes, never considered that! Interestingly, those required to sign off on release of source code (e.g. company execs) may not even be able to be certain the so

Yikes, never considered that! Interestingly, those required to sign off on release of source code (e.g. company execs) may not even be able to be certain the source doesn't contain such 'borrowed' code (since devs may have left the company a decade ago, and they likely wouldn't directly admit to 'borrowing' even if contacted/asked). Can see why it's risky.