he could order possession of it treason and punishable similarly to other illegal numbers.
For the more egregious ones, there are temporary restraining orders... days/weeks/months later.
So, yes, he can do that, and yes, he can be overruled on them, and yes, that happens after some damage has already been done.
Now that Chevron is no more, EOs are even weaker than they used to be because the regulatory agencies no longer have teeth.
Premature compliance != legally required compliance. Anyone complying early to an EO when they don't have to is an idiot.