I think you're right, but how is someone supposed to know which parts go with which? I guess \pdfjs-express-6.2.1\package\public\core\pdfjs is Apache 2.0 and everything else is commercial?