It seems to me that it did its job here. The only thing a warrant canary claims to be able to do is to make people aware that a warrant was served on a provider

It seems to me that it did its job here. The only thing a warrant canary claims to be able to do is to make people aware that a warrant was served on a provider, even when a gag order prevents the provider explicitly saying so. The warrant canary at riseup disappeared, which did have the effect of making people aware of that fact. Now it turned out that the warrant was just for some malware-extortion ring, not due to a crackdown on political dissidents, so arguably a "false positive" from the perspective of what most people using riseup for its stated purpose care about. But the warrant canary didn't claim to make those kinds of fine-grained distinctions in the first place. It claimed that it would let you know when there was an unannounced warrant, and it succeeded in doing so.