The regulation creates the context to specify something like this. Writing ad hoc rules for named entities without a law or regulation behind it isn’t how our system of governance works. You first have to have a framework to judge against, either in law or regulation. You then assess the compliance of each in scope entity and issue findings.
Btw the term “malicious compliance” isn’t really a thing. The right term is “willful noncompliance.” For this they need to prove intent to be a defensible finding, which they probably could. However it would be easier to just find them in non-compliance.
I would also note this is a back and forth. What surprises me is Apple went public with their plans rather than developing them directly with the regulators. Going public with their plan creates all sorts of problems for Apple.
This is surprising because Apple is a pretty sophisticated regulatory player. For all their devices they go through many regulatory processes and regimes. They have tons of experience dealing with regulators across many regions and regulatory domains, including these sorts of policies. This is a shocking lack of cooperative behavior that won’t work for Apple. Apple is flush with cash, but governments have unlimited resources and the ability for forcibly enforce their will. It’s usually smart money to invest in appeasing your regulators in private.