According to Sect 317C, a "designated communications provider" includes:

    A person is a designated communications provider if ...

    6. the person develops, supplies or updates software used, for use, or likely to be used, in connection with:

      (a) a listed carriage service; or
      (b) an electronic service that has one or more end-users in Australia

    ... and the eligible activities of the person are ...

      (a) the development by the person of any such software; or
      (b) the supply by the person of any such software; or
      (c) the updating by the person of any such software

So individuals can definitely be targeted -- it's specifically in the bill. In your parlance, all individuals that "develop, supply, or update software that is likely to be used by an electronic service that has one or more end-users in Australia" are entities and not agents. They are defined to be a "designated communications provider" and the same rules apply to them as any other "designated communications provider".

The difference between can and will be is huge.

Look at it from their point of view... they approach some developer and it's amateur hour. The dev might get stroppy, there's all sorts of infrastructure problems, they might not do it right... it's a mess.

But if they approach the CEO, it gets done right. The CEO brings in Legal, who promptly shit themselves. They bring in the CTO, who is told to shut up, sign this NDA, and work out how to make this happen as fast and painlessly as possible. No problems, the bad things get done, no-one gets told anything, all good. Shit continues to roll downhill...

But now you have a dozen or more people who know what's happening and we all know, three people can keep a secret if two of them are dead.

I'm not sure the point is actually to keep it secret, but (as with all government "services") to cover the arse.

Also, if you were an employee in a company in this situation, and you'd been told that the security of the nation depended on your silence, and more to the point, you'd be locked up and your career ruined if you went public, what would you do? Whistleblowers are pretty rare, because the consequences of doing that are huge.

It also applies to former employees. Yes, you can be asked to hack into previous job's systems

Wait... would this also apply to foreign developers who travel to Australia for their vacation?

Like any law, it applies to those that Australia has jurisdiction over. Visitors to Australia are under the jurisdiction of Australian law.