Definitely just a misuse of the term. "Poison pill" doesn't just mean a terrible provision of legislation - it's possible for legislation to be terrible while conceived entirely in good faith. In this case it's bad legislation due to EU legislators not understanding open source.

A "poison pill" provision or amendment is an element deliberately added to turn people who otherwise would have supported the legislation against it. The person proposing the poison pill is acting it in bad faith - they have no expectation of it passing, they might not even support the idea themselves - the only reason it's added is to make the original legislation's supporters drop their support, killing said legislation.

I don't think anyone is seriously proposing that the EU is deliberately hamstringing open source in order to kill their own cyber-security act. They've just written a bad piece of legislation.

In contracts, a poison pill is typically a clause that makes some kind of action prohibitively expensive, usually "killing" the value of the contract. But that's not what this is, nor is it what the writer means.

The use of the term here is unfortunate because it's not a poison pill in this typical legal/contracts sense, but rather the writer's attempt to characterise the clause as a deathblow for OSS devs.

I wondered that. The implication of "poison pill" is that something that looks broadly OK actually contains a detail that renders it very perilous. The canonical example is a company arranging its finances in such a way that a hostile acquisition is too dangerous to risk.

This isn't a detail; it's the whole point.