SHA pinning on GitHub does not always imply account pinning, even where the account name is explicitly specified along with it.

So some of the extra steps are meaningful. Though I am still not convinced they could not have been implemented in a deliberately backwards-incompatible way to Github action in general, keeping the syntax and removing only the special case that is never both intentional and non-malicious at the same time.