Samsung *can* legally do this (probably).
Question as to whether Samsung are legally able to enforce remote deactivation.
Different regions have different laws concerning recall onus and methodology, but Samsung have liability and exposure here, and are required by law to apply remedy. As the manufacturer of the device, they cannot remove themselves entirely from the liability chain, and if somebody gets killed (or many somebodies, e.g. on an aircraft or a bus), they will still be in deep trouble even if they've taken all reasonable measures to ensure a complete recall. Hence the heavyhandedness in removing the problem product from the marketplace.
As regards whether they're allowed to, the law generally requires demonstrable necessity, paucity of viable alternative and a mechanism to compensate for direct loss. if all of these are present and correct, the law may well support a forced recall.
Example; a privately owned house is standing in the way of a public development, and the owner refuses to sell. The council applies for a Compulsory Purchase Order to force the owner to sell. Courts look very dimly on CPOs (and they are granted very sparingly), but depending on circumstances (absolutely necessary, no alternative, adequate compensation offer), a CPO may be granted if the development can be considered For The Greater Public Good. The homeowner is free to negotiate a settlement, but cannot refuse to sell.
IANAL, but do work with lawyers in Contracts & Negotiations (and IP).