It forces Europeans wanting to build hardware startups to go overseas, so there's even fewer new European hardware companies and Europe becomes even more dependent on the US and China.

Just like everyone left when the GDPR went into place? Having safety standards in place (and yes that also means documenting them) can even be a selling point. To have demonstrably secure hardware according to a standard can be highly desirable.

I think losing the companies that don't have security as a main priority isn't too bad. I assume that the EU will create import restrictions if there is a meaningful shift to avoid EU rules.