So looks like systems guys like me still have a job but the devs are screwed?

You don’t need to root your phone, just unlock the bootloader. But yes you will need to hook it to a PC or maybe another phone to make it work. I did mine off a PC.

Not enforceable, what will they do about offshore VPNs? Many major VPN companies are already based outside of the US

You can opt out of it by putting your phone in “developer mode” or by using something like LineageOS