Are legal departments in the habit of reviewing all code line by line? Seems like that would be cost prohibitive...

Obviously they aren't, but just as obviously, "the legal department didn't review this, therefore it's safe to assume it's legal" would not pass muster with said legal department. :) Kiro's comment ("if someone gets access to their code and sees all the violations they're screwed anyway") is probably technically accurate, even if in practice you're unlikely to get caught. As other people have noted elsewhere in the comments here, the Google v. Oracle case over Java definitely suggests that verbatim copying of just a few lines, even for trivial functions, is enough to get you in trouble if those lines aren't licensed in a way that lets you do that.

No legal come up to you and say stuff like:

"You guys aren't using any free software are you? Because you can't do that."

"You mean copying software source code without respecting the license, right? Because we absolutely respect all licenses fully."

"No I mean you can't use Free software! It's a clear management directive! What are you doing?!?"

"Is that an apple laptop you're using there? Ever had a look at the software licenses for it?"

Legal are generally idiotically ignorant about the real issues. Whose fault that is we can argue about.