Maybe I'm misunderstanding, but under the previous process, submitting a policy with an update freezes it to a specific version. That holds the developer to account at least for that update.