As a open-source-license expert dev, in the past I've been able to offer a lot of value to my employer by assembling that list in such a way that the buyer could have high confidence in our audit of dependencies.

This doesn't protect anybody against illegal copy-pasta by ignorant/irresponsible devs, though.