the problem isn't your risk, the problem is the risk of the users of the project. if the code is owned by the company, your re-licensing isn't legal, and that could put other companies using it at risk.
Right, but, they never owned it, and would never attempt to assert that. So in hindsight (and similar to GP) compliance was a worse and more frustrating option than simply never mentioning things.