It seems like what the UK government is saying is: A. Either we outsource security-related tasks onto you, as companies (which I think has huge ramifications),

It seems like what the UK government is saying is: A. Either we outsource security-related tasks onto you, as companies (which I think has huge ramifications), or: B. We shake you down as a penalty (arguments about whether the tax should be paid already notwithstanding). The consequences of A, alone, are worth an entire discussion. It means compromising everyone's security to some extent, and having these companies as active participants in the security state (or perhaps, more than they already are...).