The difficulty in distinguishing the two is likely intentional. At my previous org, Oracle sent a spreadsheet of IPs to my company's compliance department which they claimed were using the extension pack and so violated their license agreement. They demanded proof of the license.
The vast majority including I, only ever used guest additions (GPL).
> The difficulty in distinguishing the two is likely intentional.
That would not surprise me. Back when we were considering virtualisers many years ago, the issue was one of the reasons² I recommended against vbox despite using it at home - it felt a bit too dark-patterny¹ for my tastes. We went with a VMWare tool instead.
[1] though I'm not sure the term “dark pattern” had been coined, or if it had it was in my vocab, at that point
[2] another being Oracles general behaviour at the time - this was after their purchase of Sun and therefore Virtual Box.
The vast majority including I, only ever used guest additions (GPL).