The investment firm that first publicized cybersecurity problems with St. Jude devices last August took a victory lap of sorts in public statements but also expressed skepticism about St. Jude's new software update.