As far as I can see, this law only requires Apple to inform the government of upcoming updates that might interfere with government tracking/5-eyes bs.
Certainly still an utterly shit rule that should 100% be ignored, but nothing about banning security patches worldwide.