I think you're right, but even if they were effectively doing these things already, it does seem likely that individual users don't actually have the ability to give permission for them (on behalf of other contributors to their repos). I guess previously we just had a potential legal quagmire that most people were happy to edge around, blithely whistling.