Yes, I scratched my head trying to understand what this accomplishes. It just puts a tag back instead of a SHA but now moves the SHA (locked in) to a separate file that now needs to be verified ? I fail to see how this is better or needed.

SHA pinning on GitHub does not always imply account pinning, even where the account name is explicitly specified along with it.

So some of the extra steps are meaningful. Though I am still not convinced they could not have been implemented in a deliberately backwards-incompatible way to Github action in general, keeping the syntax and removing only the special case that is never both intentional and non-malicious at the same time.

Enforced through GitHub Actions that is :)