The legislation (Cyber Resilience Act) aims to enforce some standards and add liability around software products, to enforce that vendors don't just throw somet

The legislation (Cyber Resilience Act) aims to enforce some standards and add liability around software products, to enforce that vendors don't just throw something out, never touch it again and it becomes a problem (customers stuck with paperweights, security holes exploited). The problem is that if you enforce that sort of thing on random open source projects, many will be simply incapable of even trying to follow the legislation because they're a small one-two dev team that cannot navigate complex laws. So, progressively, more and more exceptions have been added to who does the regulation apply to.