The goal of the EU is not to "go after any business", but instead to help them stay secure online (I know, people outside EU find it hard to believe that EU makes regulations to actually help people). EU considered various ways (see Section 3 "RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS" of the Memo that precedes the regulation text) but concluded that putting the burden on users to check the software (and all transitive dependencies) is secure and is fit for commercial use is too big. This is also consistent with the regulations on construction experts to make sure bridges are safe and on doctors to make sure the prescribed meds are relatively safe to take, instead of putting the burden on pedestrians and patients.
I hope you'd agree that we'd all be laughing right now if EU instead mandated businesses to use only commercial-grade software, joking about how are they going to run cloud VMs without the Linux kernel, GCC etc. EU fully understands that the world of software is thoroughly built on OSS, whether we like it or not.
It's also not a secret that many companies rely on OSS as a springboard for adoption, e.g. MongoDB. EU does not want to allow Mongo the company to avoid compliance merely by saying that their product is open-source(ish). And by the way, the regulation would require software to come with a secure by default configuration (page 2 of https://eur-lex.europa.eu/resource.html?uri=cellar:864f472b-... ), wink wink ( https://snyk.io/blog/mongodb-hack-and-secure-defaults/ ).