Like the top answer of this post says, let's say your project uses library M. M uses the MIT license and has dependencies G and A, which use GPLv2 and Apache2 respectively. As a result, M is not legally distributable since it doesn't comply to the licenses of it's dependencies since GPLv2 and Apache2 are not compatible, and so your use of M isn't legal either.
So it sounds to me that if any of your dependencies, or sub-dependencies, or sub-sub-dependencies etc. don't comply to their licenses correctly, you can be at fault.
I know there are tools that look through your dependency tree and can tell you all the licenses it finds so you can ensure you're doing your part, but is there any way to ensure that every dependency you have has done their part and are legally distributed?