LICENSE is a pretty common convention and you could argue I should seek out this file in every one of my dependencies' dependencies - but how would I know to look for PATENTS?
Are all statements in the code base legally binding? Could they be hidden in a source file somewhere?
The BSD license contains no patent grant. You'd be on very thin ice expecting a court to rule that the BSD copyright license also implies a patent grant. And in this specific case that defense would likely never hold because the PATENTS file even if it weren't binding would signal the intent.
Ignoring (wilfully or otherwise) the PATENTS file doesn't make you any better off.
In the Netherlands, somebody was recently fined for using an image she got from a "free photo's" website. It was a picture that was illegally published on that website, and the judge said she should've checked whether it was actually royalty free. The fine was even higher than expected because she also cropped the picture, which was another breach of copyright, apparently.
I personally find it unhelpful that the program never clarifies that it is a display of binding arbitration instead of a decision by a judge. I've seen the layman confuse the two quite a few times.
Also, while I agree that they don't have to follow the law, they usually do. In the end, the 'judgement' is still based on the law and legal precedent, like in an actual court case.
My React project has 1,015 dependencies (directories in node_modules). If I didn't have locked versions then every minor automatic update could bring in more dependencies without me knowing.
Can anyone honestly say they've done such due diligence?
That seems doubtful.
And that's a real and potentially serious problem, because IP laws typically don't contain any exemptions for code you're using that infringes someone's IP rights just because it was contributed by a third party.
That said, the amount of dependencies you have locally installed is likely to be a multitude of the number you'd get if you'd exclude devDependencies, which I'm guessing don't count.