Presumably the law also applies not just to devs but to anyone who updates software, e.g. a password protected word file or any file on a password protected sys

Presumably the law also applies not just to devs but to anyone who updates software, e.g. a password protected word file or any file on a password protected system, i.e. all computers/phones, etc. The problematic wording is here, which defines a "provider": the person develops, supplies or updates software used, for use, or likely to be used, in connection with: (a) a listed carriage service; or (b) an electronic service that has one (a) the development by the person of any such software; or (b) the supply by the person of any such software; or (c) the updating by the person of any such software It is far broader than just software entering into production, but can include ancillary software.