I agree that a front-line CSR or even engineer is not likely the right person, but surely then the responsible action is to redirect the request to the responsible department or person?

Absolutely, and companies that routinely get requests like this train customer service agents on specific trigger words like "license" or "GDPR" that must be redirected. Without that training, it's not obvious why "it's GPLv2 licensed" is more compelling than the last customer's argument that the device warranty obligates you to drop everything and immediately fix the minor UI bug they reported.