Hi,
This is expected. They only take effect for the initial review request. The idea is to prevent overriding the list of targeted reviewers, or to re-add someone who was removed, based on a re-run of the algorithm. Consider for instance an important confidential security fix that may initially trigger a Default Reviewer rule adding some people or groups to the list, but the owner of the review request erases them all and assigns it instead to a private "security" group. You wouldn't want anyone re-added if you were to update your change, for security disclosure reasons. Instead, once the review request is published, those fields are meant to be your responsibility to update.
Christian