I'm sure Oracle lawyers are highly creative. But in the end, a license is only needed to permit you to do something that would otherwise be a breach of copyright, and it's hard to see how distributing an application that calls X, without distributing X itself, is an act that even requires a license, since there is no violation of X's copyright. That's especially true of course if X is called via public interfaces such as JAXP, XQJ, or JDBC. When it comes to the question of risk, I guess users are probably more frightened of defending an unfounded allegation from Oracle than they are of defending an unfounded allegation from Saxonica!