In The Stack FAQ, they claim that they are doing minimal analysis of the LICENSE file and SPDX tags.

I'd bet that this is enough to detect cases like GPL code, but I also bet that if this analysis fails instead of falling back to "unknown license, assume proprietary, don't copy" they fall back to "free lunch!". Because reasons.