>Overall I don't think EU will go after smaller projects, since that would hurt the economy in an undesirable way. I think it's more likely that they'll use this to go after bigger corporations since that's an actual security risks for member states

That is a very rose-tinted view of EU regulators. Europeans are people like everywhere else on the planet, we're not somehow immune to regulatory capture (though I feel it might help the institutions that we haven't yet powerful blocs like the GOP that set out to destroy any kind of regulation in order to prove it's infeasible). Heck, German industry giants are practically married to the state here, there's absolutely no fucking way a company like VW or Opel will go under if a rich government like Germany can do anything about it.

More to the point, the author themself is pro-CRA for a range of things that seem to have purely positive effects, as they spell out quite clearly in the article. The points brought up are nevertheless important: we shouldn't be okay with legislator making objectively shitty laws devoid of any technical comprehension or economical realism and hope it'll kinda be fine when the bureaucracy and courts actually implement it. Just having the danger of having to pay 15M€ for my open source project because it might be used commercially is a horrendous imposition.