The law does not require Apple to grant all permissions to all apps for all users. It just requires Apple to ask users if the user wants to grant elevated permissions to specific apps that they download. The user can always say "no", which should obviously be the default.

The situation is that Apple won't even allow users to grant elevated permissions to any 3rd party app, even if the user wants to.