You are confusing EU regulations and EU directives. One is automatically binding.

Read these two pages. They are fairly clear, contain references to primary sources, and disagree with your claims:

https://ec.europa.eu/info/law/law-making-process/types-eu-la...

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=LEGISSUM...

Article 288 Treaty on Functioning of the EU

(ex Article 249 TEC)

To exercise the Union's competences, the institutions shall adopt regulations, directives, decisions, recommendations and opinions.

A regulation shall have general application. It shall be binding in its entirety and directly applicable in all Member States. [...]

And the donut shop can do absolutely 0 to stop that. They exhausted their first sale doctrine, they can't stop someone from selling a rotten donut (the law can, not the donut shop).