Right, still stupid to be issuer paid, but there's also not a lot of great alternatives I suppose. Ideally it would be buyer paid, but then you have a chicken&egg problem that buyers don't want to pay for ratings on securities they don't buy, and they don't know which to buy if they aren't rated yet. Security purchasers were obviously doing insufficient due diligence & research on products, taking ratings at face value. It's like if you saw CNBC mention some upgrade of Rivian to a "buy rating" by Goldman, and said "OK then I am buying it", without doing any research.

Anyway, some structure was put in place by the government settlements. For example in Moodys government they agreed to:

* Separation of Moody’s commercial and credit rating functions by excluding analytical personnel from any commercial related discussions and excluding personnel responsible for commercial functions from determining credit ratings or developing rating methodologies;

* Changes to ensure that specified personnel are not compensated on the basis of the company’s financial performance;

and a few other things

The separation of concerns seems similar to the Dotcom implosion era settlements to how equity research could be paid, and that they had to be firewalls off from the parts of the bank bidding on equity/debt/loan offerings with the companies that research reports were being written on.

Probably the biggest outcome was that the market now understood credit rating agencies are barely worth the bytes they are recorded in, and they are taken with large grains of salt now.

So far from perfect, but also far from the narrative of "nothing changed".. like much in life.