I’m trying to read the law[1] on this but I’m having difficulty finding the part that forces Android devices to have locked bootloaders. There’s recital 19 that talks about “verification by radio equipment of the compliance of its combination with software”, but there’s nothing stopping a vendor from using a seperate modem / baseband and CPU (like Apple does) right?

[1] https://eur-lex.europa.eu/eli/dir/2014/53/oj/eng