My point is that if you install the code through a dependency of a dependency it should be leaving license notices entirely intact, fulfilling the license.

Of course javascript optimizers and the like might throw a wrench in the works these days, but that's a pretty recent and specific problem.