The specification isn't very clear on this. The convention is to use one Cache-Control header with all the cache directives. However, as you state in your question, is it possible that clients/browsers are combining the response header directives?

• MDN docs
• specification

The main rules are:

• Caching directives are case-insensitive
• Multiple directives are permitted and must be comma-separated
• Some directives have an optional argument. When an argument is provided, it is separated from the directive name by an equals symbol (=)