Which, so long as they provide downstream with the permissions in the open source license they offer, is correct. Whether they are violating upstream open source licenses is an almost entirely separate concern, relevant only in that it could conceivably lose them the right to continue to offer their software at all, under open source or other terms.