"Nulled" term is so many times misunderstood and always create confusion. Nulled != Bypassed
A nulled code is a code from what were removed ALL callbacks to developer website.
A bypassed code is a code that only bypass the license check and some callbacks to developer website are still active.
"files whose contents are safe for the audience to use" - About this I think we have a different point of view. Safe for audience to use, in my opinion, mean that contain clean code, without backdoor or viruses.
Mind that every nulled/bypassed code is by definition
not safe to use on production servers. It is meant for educational purposes or as "try before you buy", helping you learn new codes or deciding if that is the best code/script/plugin/theme for you to use that suits your needs.
As no nuller verify the code thoroughly (because of lack of time and it's really not worth it) it may happen (and this is from my personal experience) that they miss a RAT or a backdoor planted by the developer itself to have access to nulled codes and do whatever they intended when they added that code.
Long story short: nulled codes are for educational and "try before you buy" purposes only. We do not recommend using them on production servers and strongly suggest to do your own checks before using.
Can I install additional modules from this assembly on the officially purchased regular version and is it safe?
Not recommended. Either you go full official either you go full nulled. I don't recommend this kind of combination.
"Is it safe?" - I cannot answer to this question. It depends on how the developer have made its code and if it's nulled or just bypassed. Please take note of the suggestions above (Long story short).
I hope this answered to your questions. If you have more questions I would gladly help you clarify them.