I expect this law to be challenged in court and ultimately struck down.

Yeah, for a government that's hypothetically supposed to be encouraging better information security, creating more security exploits with bad legal frameworks suggests that they're either lying about their intentions, or not as clever as people assumed. Malice or incompetence isn't really the important part. That it's a bad solution in the first place is.

Clueless or malicious legislation.

Or both, it can be both.