I don't know the details about VATMOSS but will look into it. I agree that chat control and the initial thing about software security not having a FOSS exemption were problematic. As far as I know, an exemption for FOSS authors was added.

I think it is important to acknowledge that many regulations are not perfect and I would push for more revisions on the details (although changes in the law also have a real cost associated) that don't hit their target.