Because the EU is run by lawyers and lawsuits. They probably decided there was a risk of being sued for insufficient security if they didn't enable every security feature, and they considered it as zero impact to customers because nobody uses graphene.

Yes, but that is still very confusing to me, because you're not paying other people money so that they just follow incentives without thinking, vision or backbone.

The whole idea of buying something is giving people money for their (assumed correct) judgement, which then leads to desired artifacts downstream.