That said, it's possible that this could be implemented in a GDPR-like fashion, where non-EU companies offering services to EU persons would be required to follow these laws.

It's also worth noting that the EU and Switzerland do have some bilateral agreements [1] for single market access, though, which involves it adopting some required EU law to facilitate this access; however, that should not be relevant for this specific issue.

[1] https://ec.europa.eu/commission/presscorner/detail/cs/MEMO_1...

The issue isn't the justification, it's that the ends don't justify the means. Sometimes you can't take an action even if you perceive it'll have a good result (spying on people [immoral means] to protect children [moral end]).