I'm not defending the DMA but just going to point out that it seems like you skipped this part of the article:
"developers will soon be able to distribute apps directly from their websites, providing they meet Apple's specific criteria, such as being a member of the Apple Developer Program for two continuous years or more and having an app with more than one million first installs on iOS in the EU in the prior year, and commit to ongoing requirements, such as publishing transparent data collection policies. Apps distributed in this way must meet Apple's notarization requirements like all other iOS apps and can only be installed from a web domain registered in App Store Connect."
TL;DR - not "every scammer" can set up a website and the process is far from the Wild West you make it up to be.