You’re attributed as long as the downstream intermediaries and users/developers provide some traceable reference to your original work. Even your package’s name in their dependency manifest can serve that purpose. Anyone who wants to know the original source has a way to find trace it back to you. Some projects like SPDX can largely automate it too. It can spit out the entire dependency tree, their authors and even licence compatibility information from the data.
Whenever I use some information that requires attribution, like discussions on stackoverflow, I leave the reference links in the comments in my source code. But I rarely use their code. I learn their approach. So I’m technically not required to attribute. But that’s still the honorable thing to do.
Needles to say, AI stays true to the nature of those who peddle it. They don’t like attribution and they completely strip it.
I don’t think they foresaw this level of corporate exploitation when they chose a permissive license. But that’s our own stupidity. Always expect the worst from crony capitalists.