So I have a managed package we'll call Package Core. It has various components, incl custom fields on Account and Contact. It is licensed by user, and works as expected - no license, no access to the custom fields. I have a second package which is an extension of Package Core. That second package includes a VF page which queries fields in Package Core via JS Remote, and displays them on the page. Accessibility to those fields is checked using IsAccessible as required by Security Review.
But when a non-licensed user of Package Core accesses that VF page in the Extension package, they can see data from the Package Core fields, even though they don't have a license to those fields. In effect, my Extension package does not seem to respect license management, which seems wrong to me? What check should I be doing to ensure that if a user doesn't have a license to Package Core, they can't see the fields when they access them from a Extension Package?