The legal uncertainty is the extent of the remedies requested, for non-compliance. The SFC has been known to ask for a number of really egregious things, including the right to control or terminate the shipment of completely unrelated products. This is absolutely ridiculous. The costs are not measurable to a business.

This project is not about remedying an existing compliance problem. I don't think that someone shipping a busybox replacement is going to be an acceptable remedy to the SFC. This is about proactively avoiding a compliance problem to begin with, because the remedies requested in the busybox case are so extreme.