but there’s nothing in the law that states they have to let you sideload whatever you choose

That's pretty much exactly what the law does say.

The gatekeeper shall allow and technically enable the installation and effective use of third-party software applications or software application stores using, or interoperating with, its operating system and allow those software applications or software application stores to be accessed by means other than the relevant core platform services of that gatekeeper.

There's a provision for not letting the user actively break the device, but that's it. And it's couched in terms like "if strictly necessary and proportionate" and "provided they are justified", so it's not something Apple can apply on a whim.