Yes, in the UK for example, there will be Primary Legislation which is all debated in Parliament and you can go read that online at https://www.legislation.gov.uk/

And then there's "Secondary Legislation" some of which are available on that site but others are not. All these require Primary Legislation to enable them, but it means e.g. the Primary Legislation might say something like, "All Circus Clowns are also prohibited from entering a Red Zone as shall be decided from time-to-time by the Minister for Circus Clowns" and now that Minister just gets to make a Red Zone list, parliament says they get to do that and it prohibits Circus Clowns from entering - Parliament doesn't get to vote on updates to the list (but they do get to decide their own Prime Minister, which is why we didn't have Liz Truss for very long)

It is not uncommon for either Primary or Secondary Legislation to cite documents which are copyrighted by somebody else. Typically they are available at your public library, but as in the case decided here, that's not exactly convenient when compared to using Google.

Bang on. Until recently I had several reams of MiFID and its implemting regulations on my desk, they sensibly are very closely aligned with standards, which co-evolve with them- so they are filled with references to ISO20022, 10383, 17442 and so many others. That said, even for our very complex business needing to refer to the standards was very rare. (It still would absolutely have saved time and money, but finding someone to commit actual money to BSI or ANSI membership can sometimes get lost in bureaucracy)

The case with VDE is a good example, where the norms have law force. In contrast DIN makes a specific statement, that the norms are just recommendations (as it should!) and have no law force. Even then, often through "state-of-the-art" obligations, they end up having law force. That is BAD idea.