(Author here, my wife posted this thread; it has no bearing on the question but I am told it is good to disclaim.)

You could quibble about what counts but the core is "yeah".

Ppf3-with-undo stores literal "hey, we expect byte n to be 'foo'. on apply, replace it with 'bar'. on undo, put 'foo' back. remember: the copyrighted byte is 'foo'". Touch every byte in some way and your undo data is the entire original.

Some patches literally touch one byte. Their undo is, indirectly or indirectly, a recipe for retrieving one byte of copyrighted data. Is that fragmentary enough that it is entirely in the clear? I have no idea.