So the license "scan" is just what the package manager's metadata says? That's not even close to being enough in practice. And we already have many of those tools that do the insufficient data collection, but nice dashboard thing.
See fossology or scancode for what's really being done in a professional context.