I'm not a lawyer. But I do not see where your lawyers see the problem.

In my understanding the JCL library part still keeps its MPL license. And the whole work is GPL licensed.

See also https://www.mozilla.org/en-US/MPL/2.0/combining-mpl-and-gpl/

But again, I'm not a lawyer. Maybe I'm wrong.

WinSCP version: 5.9.4 and later

We like to use WinSCP in a commercial environment. Because of
this our licensing specialists took a view at the source code.
It seems that WinSCP 5.9.4 uses a library called JCL (source/packages/jcl)
which is clearly Mozilla 1.1 licensed. But MPL-1.1 is *incompatible* to GPL-3.0.
That's at least what our lawyers say. :(

Possible solutions
=> You explain our lawyers why there is no problem.
=> You state explicitly a linking exception, i.e. you a owner of WinSCP
licensed under GPL-3.0 allow linking the JCL library without having the
copyleft effect of GPL-3.0.
=> You remove the JCL library (it was not used in earlier versions of WinSCP like 5.5.4)

I hope you can help me...

Thanks,

Thomas