Since the Hugging Face attack, many changes have occurred—but are they meaningful?