Perhaps I have misunderstood something. Wouldn't you have to analyze all of the non-busybox modules to determine whether or not any non-busybox modules are GPL-derived?

I'm suggesting that some companies would not want to let you analyze their trade secret modules on principle even when they aren't GPL-derived. I'd say that concern is unreasonable, but that doesn't mean some companies don't have it.