Indeed they do not get removed automatically. The best approach currently is to check your userlib after downloading a newer version of your AppStore module. If after the download a JAR file occurs twice, but with different version numbers, the approach would be to delete the older version.
To make sure you do not delete a JAR file even though another module is still using it, the dummy ‘RequiredLib’ files have been introduced. They on itself don’t do anything, but serve the purpose of telling the developer which version of the JAR file a specific module is using.
Hence, only delete the JAR file if no other RequiredLib file of other modules is referring to it. In principle. If another module is using a lower version of the JAR file, also delete the older version of the JAR file, but keep the referring RequiredLib file. In principle it could be this module, using the older version, breaks. If that happens, the older module needs an update. Ask for this on GitHub.
No, they do not get automatically removed. Maybe post this as an idea?