Most European hosting providers don't KYC. Infrastructure providers are rarely held liable for customer actions in Europe. Most enforcement around this sort of thing is around sanctions violations (Stark Industries).
"simply block all routing out of the country" is doing a lot of heavy lifting. For government networks, sure. For civilian networks? It's a bit like stopping pirates from ripping video; how do you deal with an attacker that ultimately can gain some form of access? Even in North Korea external media can be smuggled in.
Those groups care about whether millions of computers are vulnerable, likely including your computer. If "immediate public disclosure" was done in all cases every vuln would be exploited and patches would be much lower quality. Shortening the disclosure timeline might be a good idea, 90 days is starting to feel long.
I got a 10 out of 10 because I've seen these strawmans in center-right arguments before. Definitely promotes thinking inside the box; the homelessness question presupposes the most expensive solution (buying the homeless homes) in opposition to annual costs that would probably go down over time. I doubt both figures.
You didn't read the article. This is mainly customer complaints, safety issues, and internal processes. Also, read the actual policy your article references; they aren't suing people for patent infringement (which is kinda cool), but they also haven't released anything. (aren't patents public?)
ATM, it doesn’t seem like mullvad is selling these in stores. If a scammer wants a quick payout with less chance to get found out, they will get the gift cards from a physical store.