There are too many things in the rules package.
The expected use case is that everyone is going to by declaring a license rule, but fewer people will be using those to produce license audit or SBOMs. Most of the people who do produce an SBOM are expected to check rules_license into their repo and modify or reuse as appropriate, so having a clear separation between the packages you modify and the ones you leave alone is helpful.