Because the people who were in charge two months/years ago understood the consent decree, were afraid of the FTC, had the manpower to actually obey it without having software engineers to self-certify with possible legal repercussions to themselves. The new guy doesn't give a shit about the consent decree, the FTC, or his employees' exposure. He also released a new feature without going through rigorous safety and compliance review, exactly the thing the consent degree mandates. If that's "nothing has changed", I'd hate to see what your busy weeks look like.