As this very news item shows, it's not particularly easy to pass laws either; GDPR took over four years from the commission proposal to a final negotiated text.

We're now at over four years[1] since initial consultations were held and there's still not a formal consensus position in the council and the encryption bypass is explicitly excluded in the Parliament's draft, so it's not like we're particularly close to a law being enacted.

Basically the asymmetry you are describing is pretty exaggerated

[1]: https://eur-lex.europa.eu/legal-content/EN/PIN/?uri=CELEX:52...