This varies. The lawyers for risk-adverse companies will make sure they follow the licenses. There are auditing tools to make sure you're not pulling in code you shouldn't. An example is Google's go-licenses command [1].

But you can be sure that even the risk-adverse companies are going to go by what the license says, rather than "community norms."

Other companies are more careless.

[1] https://github.com/google/go-licenses