In all fairness, people like me who are not security researchers cannot assess whether or not such a change is problematic. The only reasonable thing we can do

In all fairness, people like me who are not security researchers cannot assess whether or not such a change is problematic. The only reasonable thing we can do is to trust the audit. Post-audit changes, from a pracitcal point of view, mean that it re-gains the "black box" attribute.