Couldn't the CE requirements just be expanded to include "software security"? Environmentalism and sustainability are the political motivation but are not lega

Couldn't the CE requirements just be expanded to include "software security"? Environmentalism and sustainability are the political motivation but are not legally required afaik.