"The gatekeeper shall allow business users and alternative providers of services provided together with, or in support of, core platform services, free of charge, effective interoperability with, and access for the purposes of interoperability to, the same operating system, hardware or software features, regardless of whether those features are part of the operating system, as are available to, or used by, that gatekeeper when providing such services."
This means the Core Technology Fee is per-se illegal.
The only exception to the provision is security, so Apple can probably demand notarization of IPA files (although maybe not really, since Android does not enforce that at all and the sky hasn't fallen over there) but the requirement that the developer already be in good standing and have 2 million app downloads is insane and non-compliant too.