They're not even really covering their asses. They don't make an OS, they make a small but important art of many distros. They're providing a clean, standardized way for Linux distros from RedHat to Ageless to comply with the law if they choose to. Some distros will comply with the law to the letter, others will not comply out of spite. At least the ones that comply will do it in a standard way.

I am kinda giving them shit for when someone pointed out that they're essentially storing PII completely unsecured and their response was "you should use app isolation anyway". That is not a good security model.

I think the fact that they acted so quickly to comply is the problem

no, they are bending to the knee. you dont say “let’s compromise with the nazis.” you say “let’s barbecue nazis in their own ovens. dave has a fucking great nazi sauce…”