In 2024, after being exposed for mass illegal surveillance, Pakistan's response wasn't accountability. It was a new law. The EU's latest report shows why that matters.