Anyways. I don't really understand what the author is talking here. Seems like he is in a very deep forest. Since the fines start from 5 million eur... The CRA is not about FOSS developers, it's mostly about companies who create devices that we use in our everyday lives.
Apple phones do not auto install updates, now they will. Intel will think twice before implementing some untested shit. Companies will react swiftly when something goes sideways inside their product. If you enter the router market you have to provide security updates for a loooong time, and make sure the default password is not "" or admin...
Everyone, literally everyone shat on security, until now.