Revisiting Injective Attacks on Recommender Systems